All of lore.kernel.org
 help / color / mirror / Atom feed
From: Paolo Bonzini <pbonzini@redhat.com>
To: qemu-devel@nongnu.org
Cc: qemu-stable@nongnu.org, Prasad J Pandit <pjp@fedoraproject.org>,
	P J P <ppandit@redhat.com>
Subject: [Qemu-devel] [PULL 04/15] scsi: initialise info object with appropriate size
Date: Fri, 15 Jan 2016 17:04:20 +0100	[thread overview]
Message-ID: <1452873871-138914-6-git-send-email-pbonzini@redhat.com> (raw)
In-Reply-To: <1452873871-138914-1-git-send-email-pbonzini@redhat.com>

From: P J P <ppandit@redhat.com>

While processing controller 'CTRL_GET_INFO' command, the routine
'megasas_ctrl_get_info' overflows the '&info' object size. Use its
appropriate size to null initialise it.

Reported-by: Qinghao Tang <luodalongde@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <alpine.LFD.2.20.1512211501420.22471@wniryva>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi/megasas.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index d7dc667..576f56c 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -718,7 +718,7 @@ static int megasas_ctrl_get_info(MegasasState *s, MegasasCmd *cmd)
     BusChild *kid;
     int num_pd_disks = 0;
 
-    memset(&info, 0x0, cmd->iov_size);
+    memset(&info, 0x0, dcmd_size);
     if (cmd->iov_size < dcmd_size) {
         trace_megasas_dcmd_invalid_xfer_len(cmd->index, cmd->iov_size,
                                             dcmd_size);
-- 
1.8.3.1

  parent reply	other threads:[~2016-01-15 16:04 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2016-01-15 16:04 [Qemu-devel] [PULL 00/15] NBD, chardev, SCSI patches for 2015-01-15 Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 01/15] scsi: revert change to scsi_req_cancel_async and add assertions Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 02/15] target-i386: do not duplicate page protection checks Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 03/15] i386: avoid null pointer dereference Paolo Bonzini
2016-01-15 16:53   ` Eric Blake
2016-01-15 17:09     ` Paolo Bonzini
2016-01-15 19:46       ` P J P
2016-01-15 19:48         ` Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL] " Paolo Bonzini
2016-01-15 16:04 ` Paolo Bonzini [this message]
2016-01-15 16:04 ` [Qemu-devel] [PULL 05/15] vmw_pvscsi: x-disable-pcie, x-old-pci-configuration back-compat props are 2.5 specific Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 06/15] qemu-char: delete send_all/recv_all helper methods Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 07/15] iscsi: send readcapacity10 when readcapacity16 failed Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 08/15] SCSI device: fix to incomplete QOMify Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 09/15] nbd: Always call "close_fn" in nbd_client_new Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 10/15] nbd: Split nbd.c Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 11/15] nbd-server: Coroutine based negotiation Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 12/15] nbd-server: do not check request length except for reads and writes Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 13/15] nbd-server: do not exit on failed memory allocation Paolo Bonzini
2016-01-15 16:04 ` [Qemu-devel] [PULL 14/15] qemu-char: add logfile facility to all chardev backends Paolo Bonzini
2016-01-21  6:16   ` Hervé Poussineau
2016-01-21  8:56     ` Daniel P. Berrange
2016-02-12 16:49       ` Markus Armbruster
2016-02-12 16:54         ` Daniel P. Berrange
2016-02-12 17:12           ` Markus Armbruster
2016-02-12 18:04             ` Daniel P. Berrange
2016-02-12 21:53               ` Daniel P. Berrange
2016-02-15  8:23                 ` Markus Armbruster
2016-01-15 16:04 ` [Qemu-devel] [PULL 15/15] qemu-char: do not leak QemuMutex when freeing a character device Paolo Bonzini
2016-01-15 17:42 ` [Qemu-devel] [PULL 00/15] NBD, chardev, SCSI patches for 2015-01-15 Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1452873871-138914-6-git-send-email-pbonzini@redhat.com \
    --to=pbonzini@redhat.com \
    --cc=pjp@fedoraproject.org \
    --cc=ppandit@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=qemu-stable@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.