From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50116) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aB2Ou-0002uF-KJ for qemu-devel@nongnu.org; Mon, 21 Dec 2015 10:29:29 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1aB2Or-00054C-SZ for qemu-devel@nongnu.org; Mon, 21 Dec 2015 10:29:28 -0500 Received: from mx1.redhat.com ([209.132.183.28]:46308) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1aB2Or-00053H-Nc for qemu-devel@nongnu.org; Mon, 21 Dec 2015 10:29:25 -0500 References: From: Paolo Bonzini Message-ID: <56781AD2.7020402@redhat.com> Date: Mon, 21 Dec 2015 16:29:22 +0100 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] scsi: initialise info object with appropriate size List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: P J P , qemu-devel@nongnu.org Cc: Qinghao Tang On 21/12/2015 10:43, P J P wrote: > Hello, > > A stack overflow issue was reported by Mr Qinghao Tang, CC'd here. It > occurs while processing the SCSI controller's CTRL_GET_INFO command, as > the memset(2) call uses driver supplied 'cmd->iov_size' to initialise > the '&info' object. > > Please see below a proposed patch to fix this issue. Does it look okay? > > === > From 5823b4a214ede884f4ba597fdd629862620e0f92 Mon Sep 17 00:00:00 2001 > From: Prasad J Pandit > Date: Mon, 21 Dec 2015 14:48:18 +0530 > Subject: [PATCH] scsi: initialise info object with appropriate size > > While processing controller 'CTRL_GET_INFO' command, the routine > 'megasas_ctrl_get_info' overflows the '&info' object size. Use its > appropriate size to null initialise it. > > Reported-by: Qinghao Tang > Signed-off-by: Prasad J Pandit > --- > hw/scsi/megasas.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c > index d7dc667..576f56c 100644 > --- a/hw/scsi/megasas.c > +++ b/hw/scsi/megasas.c > @@ -718,7 +718,7 @@ static int megasas_ctrl_get_info(MegasasState *s, > MegasasCmd *cmd) > BusChild *kid; > int num_pd_disks = 0; > > - memset(&info, 0x0, cmd->iov_size); > + memset(&info, 0x0, dcmd_size); > if (cmd->iov_size < dcmd_size) { > trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size, > dcmd_size); Yes, it is. I've queued this patch to my for-2.6 branch. Paolo