From: Paolo Bonzini <pbonzini@redhat.com>
To: Thomas Higdon <thigdon@akamai.com>
Cc: qemu-trivial <qemu-trivial@nongnu.org>,
Kevin Wolf <kwolf@redhat.com>, qemu-devel <qemu-devel@nongnu.org>,
Paul Brook <paul@codesourcery.com>
Subject: Re: [Qemu-trivial] [PATCH] scsi: restrict buffer length to req->cmd.xfer for responses to INQUIRY commands.
Date: Tue, 24 Jan 2012 09:21:07 +0100 [thread overview]
Message-ID: <4F1E69F3.4040406@redhat.com> (raw)
In-Reply-To: <20120123181426.GA14494@akamai.com>
On 01/23/2012 07:14 PM, Thomas Higdon wrote:
> > Can you please also do the same REPORT LUNS and INQUIRY in hw/scsi-bus.c?
>
> You're talking about the scsi_target_emulate_report_luns() and
> scsi_target_emulate_inquiry() functions in hw/scsi-bus.c? By my read of
> the code, these appear safe. In both functions, I see len getting set
> via calls to MIN with r->req->cmd.xfer as one of the arguments. If
> you're referring to something else, can you be more specific?
Ugh, you're right, sorry. I just looked for if.*xfer.
Paolo
WARNING: multiple messages have this Message-ID (diff)
From: Paolo Bonzini <pbonzini@redhat.com>
To: Thomas Higdon <thigdon@akamai.com>
Cc: qemu-trivial <qemu-trivial@nongnu.org>,
Kevin Wolf <kwolf@redhat.com>, qemu-devel <qemu-devel@nongnu.org>,
Paul Brook <paul@codesourcery.com>
Subject: Re: [Qemu-devel] [PATCH] scsi: restrict buffer length to req->cmd.xfer for responses to INQUIRY commands.
Date: Tue, 24 Jan 2012 09:21:07 +0100 [thread overview]
Message-ID: <4F1E69F3.4040406@redhat.com> (raw)
In-Reply-To: <20120123181426.GA14494@akamai.com>
On 01/23/2012 07:14 PM, Thomas Higdon wrote:
> > Can you please also do the same REPORT LUNS and INQUIRY in hw/scsi-bus.c?
>
> You're talking about the scsi_target_emulate_report_luns() and
> scsi_target_emulate_inquiry() functions in hw/scsi-bus.c? By my read of
> the code, these appear safe. In both functions, I see len getting set
> via calls to MIN with r->req->cmd.xfer as one of the arguments. If
> you're referring to something else, can you be more specific?
Ugh, you're right, sorry. I just looked for if.*xfer.
Paolo
next prev parent reply other threads:[~2012-01-24 8:21 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-23 17:15 [Qemu-trivial] [PATCH] scsi: restrict buffer length to req->cmd.xfer for responses to INQUIRY commands Thomas Higdon
2012-01-23 17:15 ` [Qemu-devel] " Thomas Higdon
2012-01-23 17:47 ` [Qemu-trivial] " Paolo Bonzini
2012-01-23 17:47 ` [Qemu-devel] " Paolo Bonzini
2012-01-23 18:14 ` [Qemu-trivial] " Thomas Higdon
2012-01-23 18:14 ` [Qemu-devel] " Thomas Higdon
2012-01-24 8:21 ` Paolo Bonzini [this message]
2012-01-24 8:21 ` Paolo Bonzini
2012-01-24 13:53 ` [Qemu-trivial] " Kevin Wolf
2012-01-24 13:53 ` [Qemu-devel] " Kevin Wolf
2012-01-24 17:19 ` [Qemu-trivial] [PATCH] scsi: Guard against buflen exceeding req->cmd.xfer in scsi_disk_emulate_command Thomas Higdon
2012-01-24 17:19 ` [Qemu-devel] " Thomas Higdon
2012-01-26 7:50 ` Paolo Bonzini
2012-01-26 10:41 ` Kevin Wolf
2012-01-26 10:53 ` Paolo Bonzini
2012-01-27 5:59 ` [Qemu-trivial] " Stefan Hajnoczi
2012-01-27 5:59 ` [Qemu-devel] " Stefan Hajnoczi
2012-01-27 8:44 ` Paolo Bonzini
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F1E69F3.4040406@redhat.com \
--to=pbonzini@redhat.com \
--cc=kwolf@redhat.com \
--cc=paul@codesourcery.com \
--cc=qemu-devel@nongnu.org \
--cc=qemu-trivial@nongnu.org \
--cc=thigdon@akamai.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.