From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023072.outbound.protection.outlook.com [40.107.159.72]) by lore.virtuozzo.com (Postfix) with ESMTPS id 67A218045D for ; Mon, 26 Oct 2026 13:06:24 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=DayHxToBHzyb+0lDnBXfin+374D4claYlTxdCWID90c+QGZ8JAXlpiGJXl7Ju9iOHo9SfLdXdV7jPrzWb42fHDxbEHa3SembSRbWMyTpWfUw/3M1zdgmloWBeguNdzBKqeLCg3mC0Afhe32iCe4WNu0kWEA3TLSaQpf+V3YWKPqywbpFdv9R0mYbpyEx7jTvZDxCulmU8ElyA0m1MEvamGGfcz7yMGWOTbsTwLFenQT+BLZ3xW3TPzSaJbMrf4D9GWvpPN7MWfBiBtCMgaqrmRki9Gikyabtccph8fhS9dXK+Hb0u8G5B44oYtmhX2/m/Vao7+vIwCa/4S6Rx/GjDw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=5A6fostlYhC+gFbxvVt/V42sy2XrlatPApmm61p16o4=; b=M3ywj1734s12qJToYI2ki8G/8shIda3DWApqdgPOcp56D12YNlDj8Z6JBl9s3GKNfjVzKkRJrvXxzesrVAMkjZMs3+e6BLA4iKDnWfc07zA52dJaTxWhDV/EzG1R9WPqH+cN5WrTY9xLgSR7iDL7doxKYO+31BvZjr+QKy4auhZv196gnTYi4MNNvMigWV1h3Bn2QZIM9FMVJYu2+HPHsC0/L33AVERDwOwyGcH50waP0nf3DLejJSkgDgPcqW8HfkvH3gk2DtweBD0Ntky9HoPAlMnKwv5lGPL7Dz2YDiMO8mjDhpKGXYxRgEAzTNAJSkr/wYjQZaEBDOz1Szv1bg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.1) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=5A6fostlYhC+gFbxvVt/V42sy2XrlatPApmm61p16o4=; b=pLcXdoT5W9AKTIdk7ztYPjlr4At7ifj+ASCSdOOmwOY3ePXOPgYfkYGqTss6PIH16TKspcV/6zxn1TvRqL8pKW2U+27zLKHOfemJiagKKcq/Pkz4RQNRvAEFg5FFx659YS3vC0ev7Yf8z6DetVeThUNeQtDgHUx9H7RmmKRg4tY= Received: from AM8P251CA0029.EURP251.PROD.OUTLOOK.COM (2603:10a6:20b:21b::34) by VI0PR08MB10654.eurprd08.prod.outlook.com (2603:10a6:800:20b::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 13:06:19 +0000 Received: from CPH1EPF0000051A.eurprd04.prod.outlook.com (2603:10a6:20b:21b:cafe::20) by AM8P251CA0029.outlook.office365.com (2603:10a6:20b:21b::34) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.22 via Frontend Transport; Mon, 26 Oct 2026 13:06:19 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.1) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.1 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.1; helo=b224-1.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-1.smtp-out.eu-central-1.amazonses.com (69.169.224.1) by CPH1EPF0000051A.mail.protection.outlook.com (10.167.241.229) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Mon, 26 Oct 2026 13:06:19 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1793019978; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=5A6fostlYhC+gFbxvVt/V42sy2XrlatPApmm61p16o4=; b=owkU2XV724uMVkjiEA51F5A8u5yaG/t7lEwxrpiejuoYXJb8w16V3AwWiIx6L9vA 0de5sIV2sKHqVSpQ1mReblw1Mpqhy3oMNwKgEyKKbiqSE5zeWaTXrl5h++SmMhm+8Di ONmqEKZ4onrpfNyNNZvQiXPcfyrtkqzoHpCIUXsX/JLmttyBtnXX3y5rSxgE+K6EMnw Hmp008liWWMb7jcXY4amJCFmvWll76bNrQoablcekW6E9aQe1OhK3V5n7RDLRzj3LHq suosgyAOUsZ/ZbPU0reWd2VctEOwY6vLwOblP6moGy3ofdwEZRPVJiBOTN2U7J8u8B2 e3GeDy8eZA== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1793019978; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=5A6fostlYhC+gFbxvVt/V42sy2XrlatPApmm61p16o4=; b=OJ+HIOBbaJ7SYqjJPQEvJjDTnXYpWkS40mamdJF/xV831wfXs2q0GpRGxGerCQZM ej9yYhfLUMSw49y7329TvHWtLxzI/K7dtk41LPCeBlMlcPxTpvaM5U/OC8Z4+EUQpxl M6JHNsRqv2vYZgfGS2JQoh29mWblVtepn/OKVf5M= Message-ID: <010701a17851a366-87c0dc8c-7c11-4d25-9176-4d4c9b5575ba-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH hci-8.1 1/2] scsi-disk: fix out-of-bound read in WRITE SAME #VSTOR-151631 To: "Denis V. Lunev" , andrey.drobyshev@virtuozzo.com Cc: svt-core@virtuozzo.com, den@openvz.org In-Reply-To: <20261026130349.271706-2-den@openvz.org> References: <20261026130349.271706-1-den@openvz.org> <20261026130349.271706-2-den@openvz.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Mon, 26 Oct 2026 13:06:18 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.26-69.169.224.1 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CPH1EPF0000051A:EE_|VI0PR08MB10654:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 50b60af3-d91c-498a-674a-08df3361ed0c X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|48200799018|376014|9140799003|32142699015|61400799027|18002099003|22082099003|16102099003|5113699003|4113699003|55112099003|13003099007|56012099006|5063699009|4143699003|261021121427099003|261022105027099003|10067099003|261009223027099003|261022115727099003|261022075727099003; X-Microsoft-Antispam-Message-Info: 7gnsWq2evmtav6AJHqYuvWAuqIAi/8Y3ozVaYYdLG0DfPG5VCr1JAR5WHY4hKCHL/ljLyIrcD0odImmFtTkYTyq9LW8HY2k636WEv5xtWX4dHoPpC7blLFW6eim6T7BRMmEi6ZoiZsFeIKXLF8kUxYjWSraieZrNeZvYKhRGRDuqs5e0kqm3yyq4ehqdj/XizOTuTFDSeVOFDaWWYwrp68SVFjvQy2RJKQvWvOxR0SSNSMP0DL2+LG6OHV36VewofeAJcQFDmVy7Dl8EFh6DVekeirXoxA0IBgDribH638Ea4SZ7M+NmQAVCjCfneaGhFEDGtoD9mNrm1yNl9TW1pWyIU9/joletnp5VGxcROgDZJeComwjd2cPLMmYIge/c7IMdvLzWGHKvb5iyoyg0i7HqDnnh/mqN58ZJVdEX+HTJZ6Gyv9Uo+j2KiuRGS6xTkYdzWha7O+s6HOuQQCeNh1nkQ1/Z/j/DX/9LIZ7ZaemYWbc6vTdhZfQ8GxXq+OSmjIlaCdfi9vj0u9lIKoxCk1wWzWIW9iQI1XNYE6Zuu9KAQHbMnMthSHGz8OpdhbhAouvBdveDPAHrKXv2h+7aiW7IH8EsJmr0uObYtFA0pf3VjOBI/vwBpz4EDO/lBwxi6XMm3iIxu9IQhaM2xAwB9+TGXVvHHD0VAy8R+KyOLVcFkSyzhtzHPRy8DBwBPbNJfZG6NYwZYu7ojcyUYhZFVjG/xjj9E//w41t1P04NjN71KKksRNASSjt4kWdfpQdVR3JhHXWgD6L/UgmdwLXdH5xEWLkpTLeEbGJasHSBuJqKlPhOSpYrGgp4pRcCGP9JVwLzcDLyxgleSigbFZtc9uYx76hP1yD2KIs52zqMhmsArzJaYlygfkRwoH2IrgE60mu79tms2TCPM0jnhEEwPg== X-Forefront-Antispam-Report: CIP:69.169.224.1;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-1.smtp-out.eu-central-1.amazonses.com;PTR:b224-1.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(48200799018)(376014)(9140799003)(32142699015)(61400799027)(18002099003)(22082099003)(16102099003)(5113699003)(4113699003)(55112099003)(13003099007)(56012099006)(5063699009)(4143699003)(261021121427099003)(261022105027099003)(10067099003)(261009223027099003)(261022115727099003)(261022075727099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: U2T8TwFZdnWZ0ta1+G/pTh+S8zQwLaKfh4zf7G1R5cXEz1FDHX4jEMnPnAyGYIFs/qsTbwnnbPk6UVoZU2dFtsMKv7hbjiO4iJs9pKYVMoZFLmJDvZ81zeB7N42L1pr+tnS5onjzO4c7QI/Xhvj9Rg0P+i3XS+8wtzboAW6Q570VPThFXR/kNOPUmD6BIQ5qGRULTrnEOste8/DctPD9CNwZ1t4XjszGgvJ6M61aui/hkS+Tf1OcmBee9/h/E48jUnuQ+AZCS7R0jZ0Q9od1+ZurXLjNn58wwBZOzJqY3JYmLLO7msxrLxFe4aUinggy/o0h5hj1vVOUbM2hvfhxhfKN7A2FHIrwchIaEMq88DdPIZr7d4vArvHMVMOXfYU5qlO5g+Ac7waneBXZASNefZgdtAvC/mehMtO+8L57xLSQ1j23+sMvSsldyCy0s+B1 X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 13:06:19.0779 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 50b60af3-d91c-498a-674a-08df3361ed0c X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: CPH1EPF0000051A.eurprd04.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR08MB10654 > From: Paolo Bonzini >=20 > A guest with an attached scsi-hd can force QEMU's SCSI disk emulation > to read roughly 60 KiB past the end of a heap buffer, copying that out > of bounds host memory into the guest's own disk image. >=20 > WRITE SAME computes the request transfer length at dev->blocksize > when the request is prepared and sets cmd->xfer from dev->blocksize. > scsi_disk_emulate_command() then uses cmd->xfer as the size of the > request buffer. >=20 > However, MODE SELECT can race with the WRITE SAME command and guest raise > the logical block size to any value whose low bits fit 0xfe00, up to 6502= 4. > In the presence of this race, scsi_disk_emulate_write_same() will read > from memory as many bytes as indicated by the *new* dev->blocksize, > [ ... ] > Fixes: 356c4c441ec ("scsi-disk: allow MODE SELECT block descriptor to set= the block size", 2022-07-13) > Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4365 > Cc: qemu-stable@nongnu.org > Reviewed-by: Stefan Hajnoczi > Signed-off-by: Paolo Bonzini Sashiko has reviewed this patch and found no issues. It looks great! --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/2026102613034= 9.271706-1-den@openvz.org?part=3D1