Re: [Qemu-devel] [PATCH] block/iscsi: avoid potential overflow of acb->task->cdb

[Fam Zheng <famz@redhat.com>]

On Tue, 05/24 10:59, Peter Lieven wrote:
> at least in the path via virtio-blk the maximum size is not
> restricted.
> 
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Peter Lieven <pl@kamp.de>
> ---
>  block/iscsi.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/block/iscsi.c b/block/iscsi.c
> index 2ca8e72..e7d5f7b 100644
> --- a/block/iscsi.c
> +++ b/block/iscsi.c
> @@ -833,6 +833,13 @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
>          return &acb->common;
>      }
>  
> +    if (acb->ioh->cmd_len > SCSI_CDB_MAX_SIZE) {
> +        error_report("iSCSI: ioctl error CDB exceeds max size (%d > %d)",
> +                     acb->ioh->cmd_len, SCSI_CDB_MAX_SIZE);
> +        qemu_aio_unref(acb);
> +        return NULL;
> +    }
> +
>      acb->task = malloc(sizeof(struct scsi_task));
>      if (acb->task == NULL) {
>          error_report("iSCSI: Failed to allocate task for scsi command. %s",

Is it better to invoke the cb and report -EINVAL to the caller?

Fam