[Qemu-devel] [PATCH 07/11] ide: refuse WIN_READ_NATIVE_MAX on empty device

[Stefan Hajnoczi]

What is the highest addressable sector on an empty CD-ROM?  Nothing is
addressable so produce an error.

This patch prevents a divide-by-zero in ide_set_sector() since
s->sectors and s->heads would be 0.  Not to mention that a sector=-1
argument would be nonsense.

Note that WIN_READ_NATIVE_MAX can be triggered using hdparm -N 1024
/dev/cdrom.  The LBA bit will be set to 1 though, so the only easy way
to go down the ide_set_sector() CHS code path which divides by zero is
to comment out the s->select & 0x40 case for testing.

Signed-off-by: Stefan Hajnoczi <address@hidden>
Reviewed-by: Markus Armbruster <address@hidden>
---
 hw/ide/core.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 87d67b7..c7a8041 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -1262,6 +1262,10 @@ void ide_exec_cmd(IDEBus *bus, uint32_t val)
         lba48 = 1;
         /* fall through */
     case WIN_READ_NATIVE_MAX:
+        /* Refuse if no sectors are addressable (e.g. medium not inserted) */
+        if (s->nb_sectors == 0) {
+            goto abort_cmd;
+        }
        ide_cmd_lba48_transform(s, lba48);
         ide_set_sector(s, s->nb_sectors - 1);
         s->status = READY_STAT | SEEK_STAT;
-- 
1.8.1.4