From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:56899) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bgpq1-0007gZ-8Z for qemu-devel@nongnu.org; Mon, 05 Sep 2016 05:05:10 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1bgppw-0002Sl-01 for qemu-devel@nongnu.org; Mon, 05 Sep 2016 05:05:08 -0400 Received: from mx1.redhat.com ([209.132.183.28]:39254) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1bgppv-0002SZ-QF for qemu-devel@nongnu.org; Mon, 05 Sep 2016 05:05:03 -0400 References: <1472884428-9975-1-git-send-email-ppandit@redhat.com> From: Paolo Bonzini Message-ID: Date: Mon, 5 Sep 2016 11:04:57 +0200 MIME-Version: 1.0 In-Reply-To: <1472884428-9975-1-git-send-email-ppandit@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [PATCH] scsi: pvscsi: request descriptor data_length to 32 bit List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: P J P , Qemu Developers Cc: Dmitry Fleytman , Li Qiang , Prasad J Pandit On 03/09/2016 08:33, P J P wrote: > From: Prasad J Pandit >=20 > In PVSCSI paravirtual SCSI bus, the request descriptor data > length is defined to be 64 bit. While building SG list from > a request descriptor, it gets truncated to 32bit in routine > 'pvscsi_convert_sglist'. This could lead to an infinite loop > situation for arbitrarily large 'dataLen' values. Define local > variable 'data_length' to be 32 bit, to avoid it. >=20 > Reported-by: Li Qiang > Signed-off-by: Prasad J Pandit > --- > hw/scsi/vmw_pvscsi.c | 5 ++--- > 1 file changed, 2 insertions(+), 3 deletions(-) >=20 > diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c > index 4245c15..4d38330 100644 > --- a/hw/scsi/vmw_pvscsi.c > +++ b/hw/scsi/vmw_pvscsi.c > @@ -629,7 +629,7 @@ static void > pvscsi_convert_sglist(PVSCSIRequest *r) > { > int chunk_size; > - uint64_t data_length =3D r->req.dataLen; > + uint32_t data_length =3D r->req.dataLen; Why is this needed if you remove the cast in MIN, below? Paolo > PVSCSISGState sg =3D r->sg; > while (data_length) { > while (!sg.resid) { > @@ -637,8 +637,7 @@ pvscsi_convert_sglist(PVSCSIRequest *r) > trace_pvscsi_convert_sglist(r->req.context, r->sg.dataAddr= , > r->sg.resid); > } > - assert(data_length > 0); > - chunk_size =3D MIN((unsigned) data_length, sg.resid); > + chunk_size =3D MIN(data_length, sg.resid); > if (chunk_size) { > qemu_sglist_add(&r->sgl, sg.dataAddr, chunk_size); > } >=20