From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:48995) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TtJ9E-0001zi-5S for qemu-devel@nongnu.org; Thu, 10 Jan 2013 09:30:28 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TtJ8z-00027b-Fz for qemu-devel@nongnu.org; Thu, 10 Jan 2013 09:30:24 -0500 Received: from mail-vc0-f173.google.com ([209.85.220.173]:55611) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TtJ8y-00020r-8f for qemu-devel@nongnu.org; Thu, 10 Jan 2013 09:30:09 -0500 Received: by mail-vc0-f173.google.com with SMTP id f13so464892vcb.4 for ; Thu, 10 Jan 2013 06:30:04 -0800 (PST) Sender: Paolo Bonzini From: Paolo Bonzini Date: Thu, 10 Jan 2013 15:29:57 +0100 Message-Id: <1357828197-852-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH] scsi: fix segfault with 0-byte disk List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org When a 0-sized disk is found, READ CAPACITY will return a LUN NOT READY error. However, because it returns -1 instead of zero, the HBA will call scsi_req_continue. This will typically cause a segmentation fault or an assertion failure. Signed-off-by: Paolo Bonzini --- hw/scsi-disk.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index a69735b..ae9439d 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -1682,7 +1682,7 @@ static int32_t scsi_disk_emulate_command(SCSIRequest *req, uint8_t *buf) bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors); if (!nb_sectors) { scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY)); - return -1; + return 0; } if ((req->cmd.buf[8] & 1) == 0 && req->cmd.lba) { goto illegal_request; @@ -1751,7 +1751,7 @@ static int32_t scsi_disk_emulate_command(SCSIRequest *req, uint8_t *buf) bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors); if (!nb_sectors) { scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY)); - return -1; + return 0; } if ((req->cmd.buf[14] & 1) == 0 && req->cmd.lba) { goto illegal_request; -- 1.8.1