Re: [Qemu-devel] [PATCH] check SCSI read/write requests against max LBA

[Anthony Liguori <aliguori@us.ibm.com>]

Rik van Riel wrote:
> The bdrv layer uses a signed offset. Furthermore, block-raw-posix
> only seeks when that offset is positive. Passing a negative offset
> to block-raw-posix can result in data being written at the current
> seek cursor's position.
>
> It may be possible to exploit this to seek to the end of the disk
> and extend the virtual disk by writing data to a negative sector
> offset.  After a reboot, this could lead to the guest having a
> larger disk than it had before.
>
> Close the hole by sanity checking the lba against the size of the
> disk.
>
> Signed-off-by: Rik van Riel <riel@redhat.com>
>   
Applied.  Thanks.

Regards,

Anthony Liguori