From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from [140.186.70.92] (port=52621 helo=eggs.gnu.org)
	by lists.gnu.org with esmtp (Exim 4.43) id 1PKpp8-00072j-3E
	for qemu-devel@nongnu.org; Tue, 23 Nov 2010 05:10:07 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <hare@suse.de>) id 1PKpp6-0005KX-RA
	for qemu-devel@nongnu.org; Tue, 23 Nov 2010 05:10:05 -0500
Received: from cantor.suse.de ([195.135.220.2]:46872 helo=mx1.suse.de)
	by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <hare@suse.de>)
	id 1PKpp6-0005KJ-Hw
	for qemu-devel@nongnu.org; Tue, 23 Nov 2010 05:10:04 -0500
Message-ID: <4CEB939E.70700@suse.de>
Date: Tue, 23 Nov 2010 11:12:46 +0100
From: Hannes Reinecke <hare@suse.de>
MIME-Version: 1.0
References: <20101122101536.4DE10F90AD@ochil.suse.de>
	<AANLkTim_obvv33L1E-8XKvrco6ANuXmC2ZZgsd1i8mbN@mail.gmail.com>
In-Reply-To: <AANLkTim_obvv33L1E-8XKvrco6ANuXmC2ZZgsd1i8mbN@mail.gmail.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Subject: [Qemu-devel] Re: [PATCH] scsi-disk: add data direction checking
List-Id: qemu-devel.nongnu.org
List-Unsubscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <http://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Stefan Hajnoczi <stefanha@gmail.com>
Cc: qemu-devel@nongnu.org, nab@linux-iscsi.org, kraxel@redhat.com

On 11/23/2010 11:03 AM, Stefan Hajnoczi wrote:
> On Mon, Nov 22, 2010 at 10:15 AM, Hannes Reinecke <hare@suse.de> wrote:
>> @@ -172,6 +170,9 @@ static void scsi_read_data(SCSIRequest *req)
>>     /* No data transfer may already be in progress */
>>     assert(r->req.aiocb =3D=3D NULL);
>>
>> +    if (r->req.cmd.mode =3D=3D SCSI_XFER_TO_DEV)
>> +        BADF("Data transfer direction invalid\n");
>> +
>>     if (r->sector_count =3D=3D (uint32_t)-1) {
>>         DPRINTF("Read buf_len=3D%zd\n", r->iov[0].iov_len);
>>         r->sector_count =3D 0;
>> @@ -284,6 +285,9 @@ static int scsi_write_data(SCSIRequest *req)
>>     /* No data transfer may already be in progress */
>>     assert(r->req.aiocb =3D=3D NULL);
>>
>> +    if (r->req.cmd.mode !=3D SCSI_XFER_TO_DEV)
>> +        BADF("Data transfer direction invalid\n");
>> +
>>     n =3D iov_size(r->iov, r->iov_num) / 512;
>>     if (n) {
>>         qemu_iovec_init_external(&r->qiov, r->iov, r->iov_num);
>=20
> If the guest can trigger this then there must be a SCSI response (an
> error?).  Right now BADF() will do fprintf(stderr) and then continue
> executing.
>=20
> Can we abort the operation?
>=20
I've done a patch for it as per suggestion by hch.
Right now we have

    if (r->req.cmd.mode =3D=3D SCSI_XFER_TO_DEV) {
        DPRINTF("Data transfer direction invalid\n");
        scsi_read_complete(r, -EINVAL);
        return;
    }

and -EINVAL will return the sense code 'INVALID FIELD IN CDB'.
Will be in the next patchset.

Cheers,

Hannes
--=20
Dr. Hannes Reinecke		      zSeries & Storage
hare@suse.de			      +49 911 74053 688
SUSE LINUX Products GmbH, Maxfeldstr. 5, 90409 N=FCrnberg
GF: Markus Rex, HRB 16746 (AG N=FCrnberg)