From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DU2PR03CU002.outbound.protection.outlook.com (mail-northeuropeazon11021122.outbound.protection.outlook.com [52.101.65.122]) by lore.virtuozzo.com (Postfix) with ESMTPS id 6E23780474 for ; Mon, 26 Oct 2026 17:49:41 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=rGi0N7PSldbyEUUD3BZXdOuNmqQ5r9ObF0ug94nt1p3Yu19dpWQsnMHSAYdaxD27ZbyGJmPi4JwiqdjLlVnV+fthFbRu16D043KHbbYqCdlc3A0jzUjGFZ+fuisesGU7GTc8dbQNtmyqVK6xmD3WUybLlABmLcF3mw+1cvO64A2WBOB3tPTMSYZRjGZpVWDZAekKHbcUmO0jdAkUTRBeYE/zoef7nI8PQUmrTeh3bHdruVSyQKlxXwpS/IZIhcFZ+pyrtgCNXxbeYvXUKy5FyQGqrXurZvIfqGypa//aRVl0NFQjb/e33fLiXese7t/u3+i1UN1z584fJNWDVfIc3A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=MiFlyMyknDL14v1DSvLMwqPb1VmWRH6ZEbEWj7EBYNM=; b=tVOtx3WnJfzUdkGG9+HE1/Lwl5HK0l48vBzEb0DGEfy4kC9KCU/7Srnyi62Nt+pOaEC+I1qVnyMMmPu7LjPfnYo/TAK4CmlWc6PpnL2qu2hHN+tWaI66SEUbpurIq5UHmktQBAnYMHwbD6Mnq6nEYMHJdJtCtV4VQ7F7FYBn0622PsGNOHGvh4jmUHqiryHcNRIVr5xusAe9K3pjKVw5nNSQ5lYb8RyjeyE+CCCpjql/Md3/rMZAelNjsHVbwociKQatN/u1Pq6vta7GUqAh+oLzgoYtEAfXaObv+qCr2Nf+GD37VvfOtb9gQjp8kEPkyuv1wvencvbXLWSa5mAz3g== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 2a00:1450:4864:20::32d) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=openvz.org; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=openvz.org; dkim=pass (signature was verified) header.d=openvz.org; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=MiFlyMyknDL14v1DSvLMwqPb1VmWRH6ZEbEWj7EBYNM=; b=J1HUHaEK9+quyz6B1tN38L5fRZ3bKE6HVw5Te/mqDWf88vzbw6YR3MD8a5UsUcu25y1KVMIx60h3AnoSex4bI7y8yb9jCGB+VETznvQ0V6sz98D/PTFuqydqPYBw8kcQkMeJ2mL4FNnNRFkDp+lPLAgKaGnA3WRTmvtGV8Z6HlI= Received: from MA3P292CA0010.ESPP292.PROD.OUTLOOK.COM (2603:10a6:250:2c::12) by AS8PR08MB6472.eurprd08.prod.outlook.com (2603:10a6:20b:336::11) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 17:49:34 +0000 Received: from MA3PEPF00000408.eurprd04.prod.outlook.com (2603:10a6:250:2c:cafe::30) by MA3P292CA0010.outlook.office365.com (2603:10a6:250:2c::12) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 17:49:34 +0000 Authentication-Results: spf=pass (sender IP is 2a00:1450:4864:20::32d) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org; Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:20::32d as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:20::32d; helo=mail-wm1-x32d.google.com; pr=C Received: from mail-wm1-x32d.google.com (2a00:1450:4864:20::32d) by MA3PEPF00000408.mail.protection.outlook.com (2603:10b6:140::199) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 17:49:33 +0000 Received: by mail-wm1-x32d.google.com with SMTP id 5b1f17b1804b1-4a4d7ae1ae9so16327395e9.1 for ; Mon, 26 Oct 2026 10:49:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1793036972; x=1793641772; darn=virtuozzo.com; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=MiFlyMyknDL14v1DSvLMwqPb1VmWRH6ZEbEWj7EBYNM=; b=EUfyOHTOyI3PuiaS+jBAgSYGBgWy3mW++Ll1JvBcnmSxySBzXYla5k1QFB+d9fyy9V yljYSWJ2DtWQHi3Rdng+HW6bX1QSpJH8hWWg2rjQ6RrwSqok37ZYSlfF8mI4/7MQG6af fYLZeyz0YxTkLCuM71t79RbfdJPpS0Nc+uxfE2U3u0d+/d63oZI74nXHXdg7ANPd7FF4 lms/HXZ040ygOm0OEAtOq7aNZ3itCvLFWFjuwZXWxuffX5W83UwW92MeCVLTaTmXywB2 5sYsqV//wLB6vqJALUJdhp7VAzOGLpPy+iTAA1FMDYy2PW0SgkKZzwHM44hANUcIRrf9 A4Cg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793036972; x=1793641772; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=MiFlyMyknDL14v1DSvLMwqPb1VmWRH6ZEbEWj7EBYNM=; b=cpEoS4AUu4XxDffeQpJOtIqOTgaUhR5LCgeZe+DF0sTTYpkKZTWhuM6pWFqL+pmnrY gxyd8EzKiG6uJvku52w2RTXMWNmEBDvY3M+QXpxLIZ3t3ts9HS671cZx8nnvX/LXC8Al ummwNLVmfMARLkNIT4TMD5dWZ3qLk3XNW6MzXsbw0988/3cFko+hMwemn6NMOwkh0HkT i60Ugoz9y41gdM+wPA5Tb9aw8+n1qToK7lgwk8lm3XerBwqmUUiNNHj9brWfEijd+sik ZwGigqVq2gNE01WFTNfY8jsEdPzQoIOCIKZMY7bKcyY5qUKT9LMQDMwrK1jsv7DD2BT9 0XBQ== X-Gm-Message-State: AFq9FYL5Of6Ub8J+IdrWrZbPLmFLqSFNSMLvymI8ng9suxnW796WNb5f 2g9NMgUQEeBI2qlFz3duscct7+3QX/C1Jm4/Nr/xQHgkaZ45mMwiGeRbkNC9y/L/R16ooZjtVwm GMx0RPwo= X-Gm-Gg: AYBFou1niK4KShL4LuKJKRJZ8IUsn6SsxWNHiC2wUNvvGhoGKesidQj18Xu1JjQeTjJ 4T4T+Fn1jh1/mQfqF/fUddzz+MQ2rpMin8BhU5aUL/rBIG+M7eb/WsYbdkHFxG4VgKdz2ZKUt5U VVFOU9jokbVrMJ4fmutApVoc7rkdNfz56rkH3yFWRcD+yj7B2A5O3ui1O0Df59jmGtaDL1rj2l7 r+Tqt53UJEBBaKoHY3UiVjtshyTxncUyfarrhvVycph0ZH7+ea1aHHZQy58IohVYB8lS4Z+sRBw 9Qaam4oenJrg1vjPrmQ5ldKmLfFhTBZt0nwya+kdqNtSfr3hzMhXmiK8srfwDHHPwxvkkAo5Yax TfI5oRX0LqjHDrrVM6FeAAeraGFahbjyM+maaAip/zR7I0fPht3kz7yAFb3UlNRm5NKE58VfZS0 +iVXF5wZ3t6BfQyLJtEaltMIG7jhSRs1CYTfl1pSbOdB6uLBGWodwNOo9+0JaO9FqQg4XIOzywp PHaorzmo3I+PYTHWzEuIHtZyLimTXkZPFNYTWgRpcKdcT8ApfE= X-Received: by 2002:a05:600c:818f:b0:4a3:2f35:38aa with SMTP id 5b1f17b1804b1-4a35acab86bmr131781145e9.29.1793036972499; Mon, 26 Oct 2026 10:49:32 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:1a6:7f7f:f573:ba9e]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4a35a574088sm196211485e9.9.2026.10.26.10.49.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 26 Oct 2026 10:49:32 -0700 (PDT) From: "Denis V. Lunev" To: andrey.drobyshev@virtuozzo.com Cc: svt-core@virtuozzo.com, den@openvz.org Subject: [PATCH hci-8.1 1/5] scsi-disk: check all UNMAP descriptors before discarding any #VSTOR-151532 Date: Mon, 26 Oct 2026 18:49:25 +0100 Message-ID: <20261026174929.685720-2-den@openvz.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261026174929.685720-1-den@openvz.org> References: <20261026174929.685720-1-den@openvz.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: MA3PEPF00000408:EE_|AS8PR08MB6472:EE_ X-MS-Office365-Filtering-Correlation-Id: d9f530cb-4421-40d6-e3ef-08df33897e4d X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 0 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|48200799018|82310400026|6059299003|61400799027|9140799003|43022699015|18002099003|16102099003|55112099003|22082099003|261026140227099003|261021121427099003|5063699009|56012099006|261021123027099003|10067099003|261009223027099003|261022105027099003|261022075727099003|261026121527099003; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?xcdP46NvBVqTEx0EcjWR7LNobaQ4yIRllOf9yFk9+vSXIIdP0/W6Y00AQZwp?= =?us-ascii?Q?rCpfie8GOF/RrYPdvRUJiJP76/LN3i15uZcDrOBJv2MvFsthVX0dpiZOneJZ?= =?us-ascii?Q?YlIA+DOyLtK1uf13/VX0tAHZA4jWG0U2tbSV5zdyH/diVgJbU1LNSytYP2tr?= =?us-ascii?Q?iIvN3smIX7BiSXjuGTnbzSZmmCdkpq1GEDHbSzzRdCAb7KaA9x2ZjyneqUsD?= =?us-ascii?Q?meWZdSLut4hp+vXKEaQDGZlu5gQye0buyPXR5ewe2SO9rUjewTtNoKAaqDWx?= =?us-ascii?Q?CtdL3yUVBlnT9rJY3E+Z1X0gauir2Gx/3Wf5/J9P99SwSu5kOTrDq6rbXYPH?= =?us-ascii?Q?7jM9xbdFm+d76pVJV+DuuEimRf7iiv1fk2iovL7M2kCnbFhmqgZyGOmNPJCD?= =?us-ascii?Q?b/5Y0TUy9/iXJtforcYPorMDlTmiNvbZNrPo0MIFRIbtgET1o2nIDihEqC6v?= =?us-ascii?Q?vCt2fw/S0NbASLhOfpb85fB54AlqvvmqyPHHdeoDTxn1+GfqohYOGenvTsF6?= =?us-ascii?Q?YQVGxszyKzmmXd6heHVROf9elvhreN1J3xLwdj47omczD4wbnnOtYp5kC65u?= =?us-ascii?Q?DqwLoZv0tub/OPFIBH2EWHHgcypJ5mmKBytP0+cXE/ectFINX/KGLEXZ0oeB?= =?us-ascii?Q?XjGdfhWFZ81KuRArt+wSs+UKmF/RAA8yRXlajFaNEZJ9YaJaiOMwIjAljkAS?= =?us-ascii?Q?lX0KG4PntcWDiEQTV2PqR2FYKy5RI/FY+3cwq5+U394RBfcDTbncnW2wu+ZP?= =?us-ascii?Q?Zc7A36WzhDHwgWracPrDaTsB/tpRwGgtPNrhCpZNngp6MdAZ9AHbzW5Vucid?= =?us-ascii?Q?Pq8p0HPxYiJok9/UkrWiPI+alSByCyztZ1douTeA/2g9vvU+BKzTpjI+ArYO?= =?us-ascii?Q?mIzsHrrbbMlsSNT3WGoKg878ncBrTWQbX9oZUNQpSNEGgRB8SmCk91XIhVB+?= =?us-ascii?Q?hco+anGvjiVojfPBCNQH7g=3D=3D?= X-Forefront-Antispam-Report: CIP:2a00:1450:4864:20::32d;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wm1-x32d.google.com;PTR:mail-wm1-x32d.google.com;CAT:NONE;SFS:(13230040)(376014)(48200799018)(82310400026)(6059299003)(61400799027)(9140799003)(43022699015)(18002099003)(16102099003)(55112099003)(22082099003)(261026140227099003)(261021121427099003)(5063699009)(56012099006)(261021123027099003)(10067099003)(261009223027099003)(261022105027099003)(261022075727099003)(261026121527099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: KQe1LEE+jCxhKrF6bKfsUKG5Np4h/2GgT9OuEz9tD4o+WLkl7yFRsG/f2JORg3O22v/07EI3NwPGszvtJznAHlqNVzt3aFve4tzRn2y4RJbOF0ewZ8EXyOefOpne976z5hwrQMbrPSrR+3C2XoeZiUvMRdpt7aLjW+/i+qnIsw0lk+MnT75Tn38nWq9wbX0h4yTMggC+6XHIcMCfXIwEIbvDqT5jcpv8qsElO2o375JDchksBA0QO/S8Eww/8rTmLf4n+5vRBBKZeqo2tWqkxtpENKd8+thFTdTl3Bs6OsQD6xegdapeuq19FSFwd24MJ5glyUANzRCLofylTaXkWI8lkrghnm65IPr9lLkxy5KUjg9deSMIFJMumZkVCh6SrOU6BxiOnPZwjPWn3iCTiJxmVZdGnQWB3fjgtBnbYsIbpvTCY/3d8CNfp8/OioKv X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 17:49:33.1484 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d9f530cb-4421-40d6-e3ef-08df33897e4d X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: MA3PEPF00000408.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: AS8PR08MB6472 List-Id: From: Denis V. Lunev UNMAP checks each descriptor against the capacity only when its turn comes, so a parameter list with an out-of-range descriptor in the middle discards everything before it and then fails with LOGICAL BLOCK ADDRESS OUT OF RANGE. Validate the whole list before the first discard, so the command either fails without touching the medium or runs to the end. Signed-off-by: Denis V. Lunev Cc: Paolo Bonzini Cc: Kevin Wolf Cc: Hanna Reitz Cc: qemu-stable@nongnu.org --- hw/scsi/scsi-disk.c | 24 ++++++++++++++---------- 1 file changed, 14 insertions(+), 10 deletions(-) diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c index a501c7ffa4a..c608fc56036 100644 --- a/hw/scsi/scsi-disk.c +++ b/hw/scsi/scsi-disk.c @@ -1763,13 +1763,6 @@ static void scsi_unmap_complete_noio(UnmapCBData *data, int ret) r->sector = sector_num * (s->qdev.blocksize / BDRV_SECTOR_SIZE); r->sector_count = nb_sectors * (s->qdev.blocksize / BDRV_SECTOR_SIZE); - if (!check_lba_range(s, sector_num, nb_sectors)) { - block_acct_invalid(blk_get_stats(s->qdev.conf.blk), - BLOCK_ACCT_UNMAP); - scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE)); - goto done; - } - block_acct_start(blk_get_stats(s->qdev.conf.blk), &r->acct, r->sector_count * BDRV_SECTOR_SIZE, BLOCK_ACCT_UNMAP); @@ -1784,8 +1777,6 @@ static void scsi_unmap_complete_noio(UnmapCBData *data, int ret) } scsi_req_complete(&r->req, GOOD); - -done: scsi_req_unref(&r->req); g_free(data); } @@ -1814,6 +1805,8 @@ static void scsi_disk_emulate_unmap(SCSIDiskReq *r, uint8_t *inbuf) uint8_t *p = inbuf; int len = r->req.cmd.xfer; UnmapCBData *data; + int count; + int i; /* Reject ANCHOR=1. */ if (r->req.cmd.buf[1] & 0x1) { @@ -1839,10 +1832,21 @@ static void scsi_disk_emulate_unmap(SCSIDiskReq *r, uint8_t *inbuf) return; } + count = lduw_be_p(&p[2]) >> 4; + for (i = 0; i < count; i++) { + if (!check_lba_range(s, ldq_be_p(&p[8 + i * 16]), + ldl_be_p(&p[8 + i * 16 + 8]))) { + block_acct_invalid(blk_get_stats(s->qdev.conf.blk), + BLOCK_ACCT_UNMAP); + scsi_check_condition(r, SENSE_CODE(LBA_OUT_OF_RANGE)); + return; + } + } + data = g_new0(UnmapCBData, 1); data->r = r; data->inbuf = &p[8]; - data->count = lduw_be_p(&p[2]) >> 4; + data->count = count; /* The matching unref is in scsi_unmap_complete, before data is freed. */ scsi_req_ref(&r->req); -- 2.53.0