From: Philippe Mathieu-Daudé <philmd@redhat.com>
Date: Fri, 19 Nov 2021 20:11:40 +0000 (+0100)
Subject: hw/scsi/megasas: Fails command if SGL buffer overflows
X-Git-Tag: v7.0.0-rc0~122^2~2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=97a2b074d150918a7a3a4065b946a52d4d0be8a3;p=thirdparty%2Fqemu.git

hw/scsi/megasas: Fails command if SGL buffer overflows

If we detect an overflow on the SGL buffer, do not
keep processing the command: discard it. TARGET_FAILURE
sense code will be returned (MFI_STAT_SCSI_DONE_WITH_ERROR).

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/521
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20211119201141.532377-2-philmd@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 4ff51221d4c..8f357841004 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -303,6 +303,7 @@ static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl)
     }
     if (cmd->iov_size > iov_size) {
         trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size);
+        goto unmap;
     } else if (cmd->iov_size < iov_size) {
         trace_megasas_iovec_underflow(cmd->index, iov_size, cmd->iov_size);
     }