Re: [Qemu-devel] [PATCH] scsi: restrict buffer length to req->cmd.xfer for responses to INQUIRY commands.

[Thomas Higdon <thigdon@akamai.com>]

On Mon, Jan 23, 2012 at 12:47:54PM -0500, Paolo Bonzini wrote:
> On 01/23/2012 06:15 PM, Thomas Higdon wrote:
> > This prevents the emulated SCSI device from trying to DMA more bytes to the
> > initiator than are expected. Without this, the SCRIPTS code in the emulated LSI
> > device eventually raises a DMA interrupt for a data overrun when an INQUIRY
> > command whose buflen exceeds req->cmd.xfer is processed. It's the
> > responsibility of the client to provide a request buffer and allocation
> > length that are large enough for the result of the command.
> >
> > I'm no expert on SCSI (or qemu), but this appears to be more correct behavior
> > than before, and makes my SCSI INQUIRY commands more successful.
> 
> Yes, this is correct.  SCSI says "The device server shall terminate 
> transfers to the Data-In Buffer when the number of bytes or blocks 
> specified by the ALLOCATION LENGTH field have been transferred or when 
> all available data have been transferred, whichever is less".
> 
> The same is already done for example for MODE SENSE commands.
> 
> Can you please also do the same REPORT LUNS and INQUIRY in hw/scsi-bus.c?

You're talking about the scsi_target_emulate_report_luns() and
scsi_target_emulate_inquiry() functions in hw/scsi-bus.c? By my read of
the code, these appear safe. In both functions, I see len getting set
via calls to MIN with r->req->cmd.xfer as one of the arguments. If
you're referring to something else, can you be more specific?