From: xiongweimin <[email protected]> Improve the CDB size validation by adding a zero-length check for additional safety. Also remove the misleading TODO comment since scsi_command_size() already correctly handles both fixed and variable-length CDBs.
Signed-off-by: Weimin Xiong <[email protected]> Co-authored-by: Cursor <[email protected]> --- drivers/vhost/scsi.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 219d9d881..2fbc328c9 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -1432,12 +1432,15 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct vhost_virtqueue *vq) lun = vhost_buf_to_lun(v_req.lun); } /* - * Check that the received CDB size does not exceeded our - * hardcoded max for vhost-scsi, then get a pre-allocated - * cmd descriptor for the new virtio-scsi tag. - * - * TODO what if cdb was too small for varlen cdb header? + * Check that the received CDB size is valid and does not + * exceed our hardcoded max for vhost-scsi, then get a + * pre-allocated cmd descriptor for the new virtio-scsi tag. + * scsi_command_size() handles both fixed and variable-length CDBs. */ + if (unlikely(scsi_command_size(cdb) == 0)) { + vq_err(vq, "Received SCSI CDB with zero length\n"); + goto err; + } if (unlikely(scsi_command_size(cdb) > VHOST_SCSI_MAX_CDB_SIZE)) { vq_err(vq, "Received SCSI CDB with command_size: %d that" " exceeds SCSI_MAX_VARLEN_CDB_SIZE: %d\n", -- 2.43.0
