[PATCH hci-8.1 0/2] scsi-disk: fix guest-triggered heap over-read in WRITE SAME #VSTOR-151631

["Denis V. Lunev" <den@openvz.org>]

qemu-kvm 8.2.0-11.vl9.71 crashed with SIGSEGV in the memcpy of
scsi_disk_emulate_write_same() on a virtio-scsi iothread (VSTOR-151631,
GMO Cloud). In the core, the WRITE SAME buffer is 20480 bytes, the
size of cmd->xfer computed at parse time, while s->qdev.blocksize is
65024: the guest raised the block size with a MODE SELECT block
descriptor. virtio_scsi_handle_cmd_vq() parses a whole batch before
submitting it, so a MODE SELECT earlier in the batch changes the block
size after WRITE SAME was sized. When the over-read does not fault, the
QEMU heap past the buffer ends up in the guest's own disk.

Both patches are clean cherry-picks from upstream master, Cc
qemu-stable and already in stable-10.0, 11.0 and 11.1. Patch 1 bounds
the WRITE SAME read by the allocated buffer. Patch 2 removes the root
cause: a guest can change the block size only on machines that enable
quirk_mode_page_set_block_size, which is only q800.

The series applies on f3c1d9ef263 independently of the other pending
hci-8.1 patches. Only x86_64 has been build-checked; q800 is not
configured in my build.

Signed-off-by: Denis V. Lunev <den@openvz.org>

Paolo Bonzini (2):
  scsi-disk: fix out-of-bound read in WRITE SAME #VSTOR-151631
  scsi: hide MODE SELECT block size change behind a quirk #VSTOR-151631

 hw/m68k/q800.c         |  2 ++
 hw/scsi/scsi-disk.c    | 17 +++++++++++++----
 include/hw/scsi/scsi.h |  1 +
 3 files changed, 16 insertions(+), 4 deletions(-)


base-commit: f3c1d9ef263edfab8d2a273078493bb766dcf8f8
-- 
2.53.0