[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 1/3] scsi: megasas: use appropriate property buf
From: |
P J P |
Subject: |
Re: [Qemu-devel] [PATCH 1/3] scsi: megasas: use appropriate property buffer size |
Date: |
Wed, 25 May 2016 17:21:09 +0530 (IST) |
Hello Alex,
+-- On Wed, 25 May 2016, Alexander Graf wrote --+
| > - dma_buf_write((uint8_t *)&info, cmd->iov_size, &cmd->qsg);
| > + dma_buf_write((uint8_t *)&info, dcmd_size, &cmd->qsg);
|
| This looks odd - can dcmd_size be bigger than iov_size? Wouldn't we overwrite
| guest memory then? And where does dcmd_size come from? I don't see it in
| master.
struct mfi_ctrl_props info;
size_t dcmd_size = sizeof(info);
->
http://git.qemu.org/?p=qemu.git;a=blob;f=hw/scsi/megasas.c;h=a63a581550a328d0326ddee4f7fe1c4ffdecc194;hb=HEAD#l1439
'dcmd_size' is same as that of 'info' object.
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
[Qemu-devel] [PATCH 2/3] scsi: megasas: initialise local configuration data buffer, P J P, 2016/05/25
[Qemu-devel] [PATCH 3/3] scsi: megasas: check 'read_queue_head' index value, P J P, 2016/05/25
Re: [Qemu-devel] [PATCH 0/3] Qemu: scsi: megasas: various OOB r/w access checks, Paolo Bonzini, 2016/05/25