If we detect an overflow on the SGL buffer, do not keep processing the command: discard it. TARGET_FAILURE sense code will be returned (MFI_STAT_SCSI_DONE_WITH_ERROR).
Reported-by: Alexander Bulekov <alx...@bu.edu> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/521 Signed-off-by: Philippe Mathieu-Daudé <phi...@redhat.com> --- No, I haven't looked at the datasheet. --- hw/scsi/megasas.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index 4ff51221d4c..8f357841004 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -303,6 +303,7 @@ static int megasas_map_sgl(MegasasState *s, MegasasCmd *cmd, union mfi_sgl *sgl) } if (cmd->iov_size > iov_size) { trace_megasas_iovec_overflow(cmd->index, iov_size, cmd->iov_size); + goto unmap; } else if (cmd->iov_size < iov_size) { trace_megasas_iovec_underflow(cmd->index, iov_size, cmd->iov_size); } -- 2.31.1
