From e035b43d7c98b1509420d41b017abcdac0de0442 Mon Sep 17 00:00:00 2001 From: aliguori Date: Wed, 28 Jan 2009 21:58:22 +0000 Subject: [PATCH] fix signed/unsigned overflows in SCSI disk (Rik van Riel) Sector numbers can overflow on a virtual scsi disk of over 1TB in size. Qemu's bdrv_read expects an int64_t, so fix the overflow by going to that data type. On large disks, we clip the capacity to 2TB instead of returning "capacity modulo 2TB". Turn sector_count into an unsigned to prevent a signed/unsigned overflow with SCSI transfers larger than 2TB. We're unlikely to ever hit this bug, but fixing it is just one line. Signed-off-by: Rik van Riel Signed-off-by: Anthony Liguori git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6467 c046a42c-6fe2-441c-8c8c-71466251a162 --- hw/scsi-disk.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c index 2a571a0f16..89b44c31b7 100644 --- a/hw/scsi-disk.c +++ b/hw/scsi-disk.c @@ -47,11 +47,11 @@ do { fprintf(stderr, "scsi-disk: " fmt , ##args); } while (0) typedef struct SCSIRequest { SCSIDeviceState *dev; uint32_t tag; - /* ??? We should probably keep track of whether the data trasfer is + /* ??? We should probably keep track of whether the data transfer is a read or a write. Currently we rely on the host getting it right. */ /* Both sector and sector_count are in terms of qemu 512 byte blocks. */ - int sector; - int sector_count; + uint64_t sector; + uint32_t sector_count; /* The amounnt of data in the buffer. */ int buf_len; uint8_t *dma_buf; @@ -731,6 +731,9 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag, /* Returned value is the address of the last sector. */ if (nb_sectors) { nb_sectors--; + /* Clip to 2TB, instead of returning capacity modulo 2TB. */ + if (nb_sectors > UINT32_MAX) + nb_sectors = UINT32_MAX; outbuf[0] = (nb_sectors >> 24) & 0xff; outbuf[1] = (nb_sectors >> 16) & 0xff; outbuf[2] = (nb_sectors >> 8) & 0xff; -- 2.11.4.GIT