Re: [Qemu-block] Overflow in Virtio-BLK and SCSI Requests?

2016-05-30 Thread P J P
Hello Stefan, all +-- On Mon, 30 May 2016, Peter Lieven wrote --+ | Am 27.05.2016 um 23:22 schrieb Stefan Hajnoczi: | > On Fri, May 20, 2016 at 11:27:02AM +0200, Peter Lieven wrote: | > > while working at the iSCSI code in Qemu I came across the following line | > > in iscsi_aio_ioctl | > > | >

Re: [Qemu-block] Overflow in Virtio-BLK and SCSI Requests?

2016-05-30 Thread Peter Lieven
Am 27.05.2016 um 23:22 schrieb Stefan Hajnoczi: On Fri, May 20, 2016 at 11:27:02AM +0200, Peter Lieven wrote: while working at the iSCSI code in Qemu I came across the following line in iscsi_aio_ioctl memcpy(>task->cdb[0], acb->ioh->cmdp, acb->ioh->cmd_len); Is there anything to ensure that

Re: [Qemu-block] Overflow in Virtio-BLK and SCSI Requests?

2016-05-27 Thread Stefan Hajnoczi
On Fri, May 20, 2016 at 11:27:02AM +0200, Peter Lieven wrote: > while working at the iSCSI code in Qemu I came across the following line in > iscsi_aio_ioctl > > memcpy(>task->cdb[0], acb->ioh->cmdp, acb->ioh->cmd_len); > > Is there anything to ensure that the cmd_len is valid when the requests

[Qemu-block] Overflow in Virtio-BLK and SCSI Requests?

2016-05-20 Thread Peter Lieven
Hi, while working at the iSCSI code in Qemu I came across the following line in iscsi_aio_ioctl memcpy(>task->cdb[0], acb->ioh->cmdp, acb->ioh->cmd_len); Is there anything to ensure that the cmd_len is valid when the requests is e.g. coming in via virtio_blk_handle_scsi ? It seems that