From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LSBnF-0003rB-LG for qemu-devel@nongnu.org; Wed, 28 Jan 2009 09:53:29 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LSBnE-0003qN-5O for qemu-devel@nongnu.org; Wed, 28 Jan 2009 09:53:28 -0500 Received: from [199.232.76.173] (port=43707 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LSBnD-0003pr-Km for qemu-devel@nongnu.org; Wed, 28 Jan 2009 09:53:27 -0500 Received: from shelob.surriel.com ([74.92.59.67]:49150) by monty-python.gnu.org with esmtps (TLS-1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1LSBnC-0001Su-7R for qemu-devel@nongnu.org; Wed, 28 Jan 2009 09:53:26 -0500 Received: from [2002:4a5c:3b41:1:213:72ff:fe17:4a9c] (helo=bree.surriel.com ident=[U2FsdGVkX1/Hur/lA9/kZmdAumrJnQstqtEMUI8OO8c=]) by shelob.surriel.com with esmtp (Exim 4.63) (envelope-from ) id 1LSBnA-00043M-Iv for qemu-devel@nongnu.org; Wed, 28 Jan 2009 09:53:24 -0500 Received: from bree.surriel.com (localhost [127.0.0.1] (may be forged)) by bree.surriel.com (8.13.8/8.13.8) with ESMTP id n0SErOnx011865 for ; Wed, 28 Jan 2009 09:53:24 -0500 Message-Id: <20090128145211.583289000@redhat.com> References: <20090128145137.396187000@redhat.com> Date: Wed, 28 Jan 2009 09:51:38 -0500 From: Rik van Riel Content-Disposition: inline; filename=qemu-upstream.diff Subject: [Qemu-devel] [PATCH 1/3] fix signed/unsigned overflows in SCSI disk Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Sector numbers can overflow on a virtual scsi disk of over 1TB in size. Qemu's bdrv_read expects an int64_t, so fix the overflow by going to that data type. On large disks, we clip the capacity to 2TB instead of returning "capacity modulo 2TB". Turn sector_count into an unsigned to prevent a signed/unsigned overflow with SCSI transfers larger than 2TB. We're unlikely to ever hit this bug, but fixing it is just one line. Signed-off-by: Rik van Riel Index: qemu/trunk/hw/scsi-disk.c =================================================================== --- qemu.orig/trunk/hw/scsi-disk.c +++ qemu/trunk/hw/scsi-disk.c @@ -47,11 +47,11 @@ do { fprintf(stderr, "scsi-disk: " fmt , typedef struct SCSIRequest { SCSIDeviceState *dev; uint32_t tag; - /* ??? We should probably keep track of whether the data trasfer is + /* ??? We should probably keep track of whether the data transfer is a read or a write. Currently we rely on the host getting it right. */ /* Both sector and sector_count are in terms of qemu 512 byte blocks. */ - int sector; - int sector_count; + uint64_t sector; + uint32_t sector_count; /* The amounnt of data in the buffer. */ int buf_len; uint8_t *dma_buf; @@ -731,6 +731,9 @@ static int32_t scsi_send_command(SCSIDev /* Returned value is the address of the last sector. */ if (nb_sectors) { nb_sectors--; + /* Clip to 2TB, instead of returning capacity modulo 2TB. */ + if (nb_sectors > UINT32_MAX) + nb_sectors = UINT32_MAX; outbuf[0] = (nb_sectors >> 24) & 0xff; outbuf[1] = (nb_sectors >> 16) & 0xff; outbuf[2] = (nb_sectors >> 8) & 0xff; -- All rights reversed.