|
 |
5544c1 |
From dd43bce420668dcde639c55bc792cedb1bb8c950 Mon Sep 17 00:00:00 2001
|
|
|
5544c1 |
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
5544c1 |
Date: Wed, 5 Sep 2012 17:46:18 +0200
|
|
|
5544c1 |
Subject: [PATCH] scsi-disk: introduce check_lba_range
|
|
|
5544c1 |
|
|
|
5544c1 |
Abstract the test for an out-of-range (starting block, block count)
|
|
|
5544c1 |
pair.
|
|
|
5544c1 |
|
|
|
5544c1 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
5544c1 |
(cherry picked from commit 444bc908611ccaf4512dc37c33ac3b54d873a62b)
|
|
|
5544c1 |
|
|
|
5544c1 |
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
|
|
|
5544c1 |
---
|
|
|
5544c1 |
hw/scsi-disk.c | 24 ++++++++++++++++--------
|
|
|
5544c1 |
1 file changed, 16 insertions(+), 8 deletions(-)
|
|
|
5544c1 |
|
|
|
5544c1 |
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
|
|
|
5544c1 |
index 1585683..3959603 100644
|
|
|
5544c1 |
--- a/hw/scsi-disk.c
|
|
|
5544c1 |
+++ b/hw/scsi-disk.c
|
|
|
5544c1 |
@@ -1449,6 +1449,18 @@ invalid_field:
|
|
|
5544c1 |
return;
|
|
|
5544c1 |
}
|
|
|
5544c1 |
|
|
|
5544c1 |
+static inline bool check_lba_range(SCSIDiskState *s,
|
|
|
5544c1 |
+ uint64_t sector_num, uint32_t nb_sectors)
|
|
|
5544c1 |
+{
|
|
|
5544c1 |
+ /*
|
|
|
5544c1 |
+ * The first line tests that no overflow happens when computing the last
|
|
|
5544c1 |
+ * sector. The second line tests that the last accessed sector is in
|
|
|
5544c1 |
+ * range.
|
|
|
5544c1 |
+ */
|
|
|
5544c1 |
+ return (sector_num <= sector_num + nb_sectors &&
|
|
|
5544c1 |
+ sector_num + nb_sectors - 1 <= s->qdev.max_lba);
|
|
|
5544c1 |
+}
|
|
|
5544c1 |
+
|
|
|
5544c1 |
typedef struct UnmapCBData {
|
|
|
5544c1 |
SCSIDiskReq *r;
|
|
|
5544c1 |
uint8_t *inbuf;
|
|
|
5544c1 |
@@ -1473,8 +1485,7 @@ static void scsi_unmap_complete(void *opaque, int ret)
|
|
|
5544c1 |
if (data->count > 0 && !r->req.io_canceled) {
|
|
|
5544c1 |
sector_num = ldq_be_p(&data->inbuf[0]);
|
|
|
5544c1 |
nb_sectors = ldl_be_p(&data->inbuf[8]) & 0xffffffffULL;
|
|
|
5544c1 |
- if (sector_num > sector_num + nb_sectors ||
|
|
|
5544c1 |
- sector_num + nb_sectors - 1 > s->qdev.max_lba) {
|
|
|
5544c1 |
+ if (!check_lba_range(s, sector_num, nb_sectors)) {
|
|
|
5544c1 |
scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE));
|
|
|
5544c1 |
goto done;
|
|
|
5544c1 |
}
|
|
|
5544c1 |
@@ -1802,8 +1813,7 @@ static int32_t scsi_disk_emulate_command(SCSIRequest *req, uint8_t *buf)
|
|
|
5544c1 |
scsi_check_condition(r, SENSE_CODE(WRITE_PROTECTED));
|
|
|
5544c1 |
return 0;
|
|
|
5544c1 |
}
|
|
|
5544c1 |
- if (r->req.cmd.lba > r->req.cmd.lba + nb_sectors ||
|
|
|
5544c1 |
- r->req.cmd.lba + nb_sectors - 1 > s->qdev.max_lba) {
|
|
|
5544c1 |
+ if (!check_lba_range(s, r->req.cmd.lba, nb_sectors)) {
|
|
|
5544c1 |
goto illegal_lba;
|
|
|
5544c1 |
}
|
|
|
5544c1 |
|
|
|
5544c1 |
@@ -1878,8 +1888,7 @@ static int32_t scsi_disk_dma_command(SCSIRequest *req, uint8_t *buf)
|
|
|
5544c1 |
if (r->req.cmd.buf[1] & 0xe0) {
|
|
|
5544c1 |
goto illegal_request;
|
|
|
5544c1 |
}
|
|
|
5544c1 |
- if (r->req.cmd.lba > r->req.cmd.lba + len ||
|
|
|
5544c1 |
- r->req.cmd.lba + len - 1 > s->qdev.max_lba) {
|
|
|
5544c1 |
+ if (!check_lba_range(s, r->req.cmd.lba, len)) {
|
|
|
5544c1 |
goto illegal_lba;
|
|
|
5544c1 |
}
|
|
|
5544c1 |
r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
|
|
|
5544c1 |
@@ -1907,8 +1916,7 @@ static int32_t scsi_disk_dma_command(SCSIRequest *req, uint8_t *buf)
|
|
|
5544c1 |
if (r->req.cmd.buf[1] & 0xe0) {
|
|
|
5544c1 |
goto illegal_request;
|
|
|
5544c1 |
}
|
|
|
5544c1 |
- if (r->req.cmd.lba > r->req.cmd.lba + len ||
|
|
|
5544c1 |
- r->req.cmd.lba + len - 1 > s->qdev.max_lba) {
|
|
|
5544c1 |
+ if (!check_lba_range(s, r->req.cmd.lba, len)) {
|
|
|
5544c1 |
goto illegal_lba;
|
|
|
5544c1 |
}
|
|
|
5544c1 |
r->sector = r->req.cmd.lba * (s->qdev.blocksize / 512);
|
|
|
5544c1 |
--
|
|
|
5544c1 |
1.7.12.1
|
|
|
5544c1 |
|