From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:41642)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <hare@suse.de>) id 1XjPw7-0005Ow-AO
	for qemu-devel@nongnu.org; Wed, 29 Oct 2014 05:53:09 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <hare@suse.de>) id 1XjPw1-0002PO-8B
	for qemu-devel@nongnu.org; Wed, 29 Oct 2014 05:53:03 -0400
Received: from cantor2.suse.de ([195.135.220.15]:59382 helo=mx2.suse.de)
	by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from <hare@suse.de>)
	id 1XjPw1-0002OV-2f
	for qemu-devel@nongnu.org; Wed, 29 Oct 2014 05:52:57 -0400
Message-ID: <5450B8F4.4050101@suse.de>
Date: Wed, 29 Oct 2014 10:52:52 +0100
From: Hannes Reinecke <hare@suse.de>
MIME-Version: 1.0
References: <1414569232-21357-1-git-send-email-hare@suse.de>
	<1414569232-21357-5-git-send-email-hare@suse.de>
	<5450B07A.8060103@redhat.com>
In-Reply-To: <5450B07A.8060103@redhat.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [Qemu-devel] [PATCH 04/17] scsi: fixup lba calculation for 6
	byte CDBs
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Paolo Bonzini <pbonzini@redhat.com>, qemu-devel@nongnu.org
Cc: Andreas Faerber <afaerber@suse.de>, Alexander Graf <agraf@suse.de>

On 10/29/2014 10:16 AM, Paolo Bonzini wrote:
>
>
> On 10/29/2014 08:53 AM, Hannes Reinecke wrote:
>> 6 byte CDBs do not have a dedicated area for LBAs, and even if
>> it certainly won't be at byte 0.
>>
>> Signed-off-by: Hannes Reinecke <hare@suse.de>
>> ---
>>   hw/scsi/scsi-bus.c | 3 ---
>>   1 file changed, 3 deletions(-)
>>
>> diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
>> index 919a86c..64d0880 100644
>> --- a/hw/scsi/scsi-bus.c
>> +++ b/hw/scsi/scsi-bus.c
>> @@ -1195,9 +1195,6 @@ static uint64_t scsi_cmd_lba(SCSICommand *cmd)
>>       uint64_t lba;
>>
>>       switch (buf[0] >> 5) {
>> -    case 0:
>> -        lba = ldl_be_p(&buf[0]) & 0x1fffff;
>
> These are bits 0-20 of the first big endian u32, which means the low
> five bits of byte 1, together with byte 2 and byte 3.
>
> The patch as is breaks (obsolete) commands such as READ(6) and WRITE(6).
>   Why did you need it?
>
Because without this patch we end up with having a (basically random) 
value in cmd.lba, and we're ending up here:

if (cmd.lba != -1) {
   trace_scsi_req_parsed_lba(d->id, d->lun, tag, buf[0], cmd.lba); 
  } 


and causing a buffer overflow when printing out the cdb.

Cheers,

Hannes