Re: [PATCH hci-8.1 0/2] scsi-disk: fix guest-triggered heap over-read in WRITE SAME #VSTOR-151631

[Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>]

Ack
Applied onto hci-dev

On 10/26/26 3:03 PM, Denis V. Lunev wrote:
> qemu-kvm 8.2.0-11.vl9.71 crashed with SIGSEGV in the memcpy of
> scsi_disk_emulate_write_same() on a virtio-scsi iothread (VSTOR-151631,
> GMO Cloud). In the core, the WRITE SAME buffer is 20480 bytes, the
> size of cmd->xfer computed at parse time, while s->qdev.blocksize is
> 65024: the guest raised the block size with a MODE SELECT block
> descriptor. virtio_scsi_handle_cmd_vq() parses a whole batch before
> submitting it, so a MODE SELECT earlier in the batch changes the block
> size after WRITE SAME was sized. When the over-read does not fault, the
> QEMU heap past the buffer ends up in the guest's own disk.
> 
> Both patches are clean cherry-picks from upstream master, Cc
> qemu-stable and already in stable-10.0, 11.0 and 11.1. Patch 1 bounds
> the WRITE SAME read by the allocated buffer. Patch 2 removes the root
> cause: a guest can change the block size only on machines that enable
> quirk_mode_page_set_block_size, which is only q800.
> 
> The series applies on f3c1d9ef263 independently of the other pending
> hci-8.1 patches. Only x86_64 has been build-checked; q800 is not
> configured in my build.
> 
> Signed-off-by: Denis V. Lunev <den@openvz.org>
> 
> Paolo Bonzini (2):
>   scsi-disk: fix out-of-bound read in WRITE SAME #VSTOR-151631
>   scsi: hide MODE SELECT block size change behind a quirk #VSTOR-151631
> 
>  hw/m68k/q800.c         |  2 ++
>  hw/scsi/scsi-disk.c    | 17 +++++++++++++----
>  include/hw/scsi/scsi.h |  1 +
>  3 files changed, 16 insertions(+), 4 deletions(-)
> 
> 
> base-commit: f3c1d9ef263edfab8d2a273078493bb766dcf8f8