Re: [PATCH hci-8.1 1/2] scsi-disk: fix out-of-bound read in WRITE SAME #VSTOR-151631

[no-reply@sashiko.virtuozzo.com]

> From: Paolo Bonzini <pbonzini@redhat.com>
> 
> A guest with an attached scsi-hd can force QEMU's SCSI disk emulation
> to read roughly 60 KiB past the end of a heap buffer, copying that out
> of bounds host memory into the guest's own disk image.
> 
> WRITE SAME computes the request transfer length at dev->blocksize
> when the request is prepared and sets cmd->xfer from dev->blocksize.
> scsi_disk_emulate_command() then uses cmd->xfer as the size of the
> request buffer.
> 
> However, MODE SELECT can race with the WRITE SAME command and guest raise
> the logical block size to any value whose low bits fit 0xfe00, up to 65024.
> In the presence of this race, scsi_disk_emulate_write_same() will read
> from memory as many bytes as indicated by the *new* dev->blocksize,
> [ ... ]
> Fixes: 356c4c441ec ("scsi-disk: allow MODE SELECT block descriptor to set the block size", 2022-07-13)
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4365
> Cc: qemu-stable@nongnu.org
> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.vzint.dev/#/patchset/20261026130349.271706-1-den@openvz.org?part=1