From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.43) id 1LSIQT-0005H1-MH for qemu-devel@nongnu.org; Wed, 28 Jan 2009 16:58:25 -0500 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.43) id 1LSIQT-0005G4-5W for qemu-devel@nongnu.org; Wed, 28 Jan 2009 16:58:25 -0500 Received: from [199.232.76.173] (port=38013 helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.43) id 1LSIQS-0005Fs-O6 for qemu-devel@nongnu.org; Wed, 28 Jan 2009 16:58:24 -0500 Received: from savannah.gnu.org ([199.232.41.3]:42296 helo=sv.gnu.org) by monty-python.gnu.org with esmtps (TLS-1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.60) (envelope-from ) id 1LSIQS-0005lQ-CV for qemu-devel@nongnu.org; Wed, 28 Jan 2009 16:58:24 -0500 Received: from cvs.savannah.gnu.org ([199.232.41.69]) by sv.gnu.org with esmtp (Exim 4.63) (envelope-from ) id 1LSIQR-00043j-7P for qemu-devel@nongnu.org; Wed, 28 Jan 2009 21:58:23 +0000 Received: from aliguori by cvs.savannah.gnu.org with local (Exim 4.63) (envelope-from ) id 1LSIQQ-00043f-UK for qemu-devel@nongnu.org; Wed, 28 Jan 2009 21:58:23 +0000 MIME-Version: 1.0 Errors-To: aliguori Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Anthony Liguori Message-Id: Date: Wed, 28 Jan 2009 21:58:22 +0000 Subject: [Qemu-devel] [6467] fix signed/unsigned overflows in SCSI disk (Rik van Riel) Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Revision: 6467 http://svn.sv.gnu.org/viewvc/?view=rev&root=qemu&revision=6467 Author: aliguori Date: 2009-01-28 21:58:22 +0000 (Wed, 28 Jan 2009) Log Message: ----------- fix signed/unsigned overflows in SCSI disk (Rik van Riel) Sector numbers can overflow on a virtual scsi disk of over 1TB in size. Qemu's bdrv_read expects an int64_t, so fix the overflow by going to that data type. On large disks, we clip the capacity to 2TB instead of returning "capacity modulo 2TB". Turn sector_count into an unsigned to prevent a signed/unsigned overflow with SCSI transfers larger than 2TB. We're unlikely to ever hit this bug, but fixing it is just one line. Signed-off-by: Rik van Riel Signed-off-by: Anthony Liguori Modified Paths: -------------- trunk/hw/scsi-disk.c Modified: trunk/hw/scsi-disk.c =================================================================== --- trunk/hw/scsi-disk.c 2009-01-28 17:16:56 UTC (rev 6466) +++ trunk/hw/scsi-disk.c 2009-01-28 21:58:22 UTC (rev 6467) @@ -47,11 +47,11 @@ typedef struct SCSIRequest { SCSIDeviceState *dev; uint32_t tag; - /* ??? We should probably keep track of whether the data trasfer is + /* ??? We should probably keep track of whether the data transfer is a read or a write. Currently we rely on the host getting it right. */ /* Both sector and sector_count are in terms of qemu 512 byte blocks. */ - int sector; - int sector_count; + uint64_t sector; + uint32_t sector_count; /* The amounnt of data in the buffer. */ int buf_len; uint8_t *dma_buf; @@ -731,6 +731,9 @@ /* Returned value is the address of the last sector. */ if (nb_sectors) { nb_sectors--; + /* Clip to 2TB, instead of returning capacity modulo 2TB. */ + if (nb_sectors > UINT32_MAX) + nb_sectors = UINT32_MAX; outbuf[0] = (nb_sectors >> 24) & 0xff; outbuf[1] = (nb_sectors >> 16) & 0xff; outbuf[2] = (nb_sectors >> 8) & 0xff;