From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:49280) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQE9u-0007en-5Z for qemu-devel@nongnu.org; Fri, 04 May 2012 04:46:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SQE9r-0007Ng-1r for qemu-devel@nongnu.org; Fri, 04 May 2012 04:46:37 -0400 Received: from mail-pz0-f44.google.com ([209.85.210.44]:52841) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SQE9q-0007F2-PN for qemu-devel@nongnu.org; Fri, 04 May 2012 04:46:34 -0400 Received: by mail-pz0-f44.google.com with SMTP id x6so2969373dac.31 for ; Fri, 04 May 2012 01:46:33 -0700 (PDT) Sender: Paolo Bonzini From: Paolo Bonzini Date: Fri, 4 May 2012 10:45:48 +0200 Message-Id: <1336121154-26517-9-git-send-email-pbonzini@redhat.com> In-Reply-To: <1336121154-26517-1-git-send-email-pbonzini@redhat.com> References: <1336121154-26517-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH 08/14] scsi: do not report bogus overruns for commands in the 0x00-0x1F range List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Interpreting cdb[4] == 0 as a request to transfer 256 blocks is only needed for READ_6 and WRITE_6. No other command in that range needs that special-casing, and the resulting overrun breaks scsi-testsuite's attempt to use command 2 as a known-invalid command. Signed-off-by: Paolo Bonzini --- hw/scsi-bus.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/hw/scsi-bus.c b/hw/scsi-bus.c index 08d5088..5fbf8db 100644 --- a/hw/scsi-bus.c +++ b/hw/scsi-bus.c @@ -735,10 +735,6 @@ static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) case 0: cmd->xfer = buf[4]; cmd->len = 6; - /* length 0 means 256 blocks */ - if (cmd->xfer == 0) { - cmd->xfer = 256; - } break; case 1: case 2: @@ -808,18 +804,26 @@ static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) cmd->xfer = buf[9] | (buf[8] << 8); } break; + case WRITE_6: + /* length 0 means 256 blocks */ + if (cmd->xfer == 0) { + cmd->xfer = 256; + } case WRITE_10: case WRITE_VERIFY_10: - case WRITE_6: case WRITE_12: case WRITE_VERIFY_12: case WRITE_16: case WRITE_VERIFY_16: cmd->xfer *= dev->blocksize; break; - case READ_10: case READ_6: case READ_REVERSE: + /* length 0 means 256 blocks */ + if (cmd->xfer == 0) { + cmd->xfer = 256; + } + case READ_10: case RECOVER_BUFFERED_DATA: case READ_12: case READ_16: -- 1.7.9.3