From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48916) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bDFXK-0003nl-83 for qemu-devel@nongnu.org; Wed, 15 Jun 2016 14:27:35 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bDFXE-0007nK-5p for qemu-devel@nongnu.org; Wed, 15 Jun 2016 14:27:33 -0400 Received: from mx1.redhat.com ([209.132.183.28]:41311) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bDFXE-0007nE-0O for qemu-devel@nongnu.org; Wed, 15 Jun 2016 14:27:28 -0400 References: <1466007376-27333-1-git-send-email-ppandit@redhat.com> <97a65801-e94d-9ea8-80f4-4caa4a8cf4a4@redhat.com> From: Paolo Bonzini Message-ID: Date: Wed, 15 Jun 2016 20:27:21 +0200 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH v3] scsi: esp: check length before dma read List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: P J P Cc: Qemu Developers , Li Qiang , Laszlo Ersek On 15/06/2016 19:18, P J P wrote: > Hello Paolo, > > +-- On Wed, 15 Jun 2016, Paolo Bonzini wrote --+ > | Actually, the commit message is wrong. The length parameter cannot > | exceed the buffer size anymore. > > It wouldn't exceed after this patch, right? Is it possible 'esp_do_dma' is > called via 'esp_transfer_data' with 's->do_cmd' set? 'len' isn't checked > there. No, it's not possible; see the discussion in reply to v1. Paolo