Re: [Qemu-devel] [Qemu-block] [PATCH] block/iscsi: avoid potential overflow of acb->task->cdb

[Fam Zheng <famz@redhat.com>]

On Tue, 05/31 09:39, Kevin Wolf wrote:
> Am 31.05.2016 um 08:44 hat Fam Zheng geschrieben:
> > On Tue, 05/24 10:59, Peter Lieven wrote:
> > > at least in the path via virtio-blk the maximum size is not
> > > restricted.
> > > 
> > > Cc: qemu-stable@nongnu.org
> > > Signed-off-by: Peter Lieven <pl@kamp.de>
> > > ---
> > >  block/iscsi.c | 7 +++++++
> > >  1 file changed, 7 insertions(+)
> > > 
> > > diff --git a/block/iscsi.c b/block/iscsi.c
> > > index 2ca8e72..e7d5f7b 100644
> > > --- a/block/iscsi.c
> > > +++ b/block/iscsi.c
> > > @@ -833,6 +833,13 @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
> > >          return &acb->common;
> > >      }
> > >  
> > > +    if (acb->ioh->cmd_len > SCSI_CDB_MAX_SIZE) {
> > > +        error_report("iSCSI: ioctl error CDB exceeds max size (%d > %d)",
> > > +                     acb->ioh->cmd_len, SCSI_CDB_MAX_SIZE);
> > > +        qemu_aio_unref(acb);
> > > +        return NULL;
> > > +    }
> > > +
> > >      acb->task = malloc(sizeof(struct scsi_task));
> > >      if (acb->task == NULL) {
> > >          error_report("iSCSI: Failed to allocate task for scsi command. %s",
> > 
> > Is it better to invoke the cb and report -EINVAL to the caller?
> 
> By the way, when returning NULL, it looks like bdrv_co_do_ioctl()
> leaks its BdrvIoctlCompletionData. This code was introduced by your
> commit 5c5ae76a ("block: Emulate bdrv_ioctl with bdrv_aio_ioctl and
> track both").

I'll send a patch to fix it now.

Fam