From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023115.outbound.protection.outlook.com [40.107.159.115]) by lore.virtuozzo.com (Postfix) with ESMTPS id 85F3B8017D for ; Mon, 26 Oct 2026 16:13:42 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FSyQvFjgJXSqA0utQqHZ7KenXgEhLQPdWz3cwePpHDwD55cit4PNFm4qC2INnw8tMrl/T/T5Tj1WtfdiZH+zGRVmDOwLk6/sLVxkhzy+gGkG3fvOwDOxhgvlfAlT0gEQEdNeHRV77/nF3iBkObCogzMvUiADTHvtDpba6ndm93O7XZhI6j955DVX9C7hyN3gfvU8PX2hykBuXQGSg1OZsp2s3mYK+xMYn79YHtjzTHkk8AdRS8WDz38/H2jtb9Nz453Y4mBCpXuiFPLE6dDyTcTz+4VJQLWzFjtb+cMPn3DqNuS1hufW716jiypdotFJppxLQMY/s620BYr0SKUicg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=0OgFRFN2R4ua58y41bYm6OE5QVZ77s5REtNmcD+pk/o=; b=yXX4Kf55Q5xW6B+fxLR8/v9NGEXzBdYrPJqr6Ty5G5EsVlECF3v+2KOw+DG/d+9OVXNrXvkDowhxNbXymoj88TFcE2EzX9tAz3ey/JbjX052ya+EDQUVVlbXHHa+pttnk2KwkY+3Q+bcL0X5DSsF2Yo+r5LU7PsH+cnJrtql0/OiXfMNaHJqn84PlLeHrUQeVur4U0JUkm0QCUBdU/Rb8HZS2Zw7HM31gHvNtYfOdBpQ3OPmI2zVOVsJKTi20BwI7FhfXgDbAQz1qpRzjJNW+cDt0xMjvANIQ9rhDGAUL2rrvQ2gMfXjVTiCup0YQqdCWSyjTg0DQ2Br0rYBw2V+UQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=0OgFRFN2R4ua58y41bYm6OE5QVZ77s5REtNmcD+pk/o=; b=Ae7H5BuWGNiwysZyL6e1VNArp4tc7JWOyXK0xkUdQC0xztxFkRtGBFoiAAwXxF8yExbU2ZQKkkXAKbCWM+CpZk9q6yKRJCiL3kkV0fcDV35IT+iP5lzMvELyB3DOXwfHJGqwh64z59q9U4DM82zUDpfFTLREbC8pdBk8G+kutgRM8I5lTJ9Rw72a2wqhOq81VFr/u8IHrJz7Gj7iMxn5xRnZV3F5kV9ir5ik6ibRWjYhgha9kDzd1I4BLxT1To7FyXCohtIM5JMzC9ShoQCfnfyqd1RjuJui9u+sYeig2wvAgAEWWL6hIm22xoT1XF0tTqgdfsKHBNuvcLWEjgHw3w== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by DU0PR08MB9463.eurprd08.prod.outlook.com (2603:10a6:10:42d::8) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.546.22; Mon, 26 Oct 2026 16:13:36 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0546.021; Mon, 26 Oct 2026 16:13:36 +0000 Message-ID: Date: Mon, 26 Oct 2026 18:13:35 +0200 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH hci-8.1 0/2] scsi-disk: fix guest-triggered heap over-read in WRITE SAME #VSTOR-151631 To: "Denis V. Lunev" Cc: svt-core@virtuozzo.com References: <20261026130349.271706-1-den@openvz.org> Content-Language: en-US From: Andrey Drobyshev In-Reply-To: <20261026130349.271706-1-den@openvz.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-ClientProxiedBy: ZR2P278CA0047.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:53::12) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|DU0PR08MB9463:EE_ X-MS-Office365-Filtering-Correlation-Id: e565a493-f292-4c78-0445-08df337c16f3 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|22082099003|18002099003|5113699003|261026135527099003|261026140227099003|261026130827099003|56012099006|261021130227099003|261022075727099003|10067099003|261021123027099003|261021121427099003|261022105027099003|261009223027099003|261021135927099003|261009221227099003|261022115727099003|261021133027099003|261022113327099003|261026121527099003; X-Microsoft-Antispam-Message-Info: n1osWn9w6RD6L37LNpp+8mW6NUWYhkz4ZigeQ7ZIF+hYSmVD/PloK+U7BSnUoTiHVWZCdqFXnOKS8FwDOtV9qmJeAWNPA+lDDqji5uJ5EgnygudBZ9YHf4zteUvNEQgAn2GRjj8Xp6zCxZrHlYqare3imEl4m4qhYG5uiWRewid6uP9Ck2tGnrL+VyyOtPE5ylxmGxFSavwsDa8tzcsFSTyzAwWGoqxA8xtYc4KnbL66eOsLSjAPb8MBdceMlPdOHVxxi2XweQnQHALBAI3+RnkjvZoPBqBfViO8hfqo8IiB1eY3hmBZ1h3M+TwF5Ao+fvyrOyi5iZr11RcY/u1Xc90oiSXODRrI4/5m+yuxTMUxlokriC09vxlsz85xDjwo41Rth4VKxRrQyPypUhPhqcGCRnk5Ax+E8+7sZNu+mCqte2HlSuoHbaXYAUuixWkcriU2imAcayMc1q9TwPIN4H1KHH8/FelOAgddL1vE0s5xjMIZ96wvy2ZbwjPWnTt/MK/S2TZkj2MlWW00a0cQqilSdicP32UzLnFtLsPZR/C16pQEPFi9/+4vX5C6RRfnvqKTNhWwVCvGGY6zJe/tr0SnQroqJmJVRvOo11sowycipwOBEA9mC9MjrjTjuP/7TQcHm549ok5iboW001j6c6eeGUqZC7PZVoPz2u0VBLY= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(22082099003)(18002099003)(5113699003)(261026135527099003)(261026140227099003)(261026130827099003)(56012099006)(261021130227099003)(261022075727099003)(10067099003)(261021123027099003)(261021121427099003)(261022105027099003)(261009223027099003)(261021135927099003)(261009221227099003)(261022115727099003)(261021133027099003)(261022113327099003)(261026121527099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?WXd1R2hPbWlGdllqcFdvd080eW9zSVliQUlqVXdIR0hpdFZkYktWUFp0V3dM?= =?utf-8?B?TEFsakxLZXpLMkdqVjBPV0FZRkFPT25ZWTdiTDg0MllpZlNIYTFRdGZiU0Zw?= =?utf-8?B?dzRCL2VhL2hmQlI5dEFZbkYwcUZkZlhSUXlITTRXR0tRZ1JMZk45cTU1U0Fj?= =?utf-8?B?MFpqOWFTWnhTZmRSa2RNOHMrWkdtc1RhZ0NFSG1rQS9DMUE3M21GRVhneHE1?= =?utf-8?B?NmRXZVpEOXY5YVpzTlBiWm1hbFBFMDhxLzFxM1dDQ3BoakwwTWhaeW5pN0tk?= =?utf-8?B?Y2EvRFMyTnltTWRGMUFUeVE4c1QvSDdKU2dieHhwTnRVcEtyMTFsbWR2ZFJs?= =?utf-8?B?MUo5UlVaTTlvSnRRMi8wSW43Tlo4NHlWZkhSTHFzdTNWS3Y0Q3dxNGNYL3dI?= =?utf-8?B?bzQ2YjdDTEZaVTZucnBRSndoeFUxWkZoSTVMWUg2MitUQ0ZaMklueEJmY2Jm?= =?utf-8?B?UmJVc3U0aHp0bTJuYVdKUmxseGp2a1FrY09EYlY1RDNHeUk1K3hCbDg3WWQ3?= =?utf-8?B?NlpKMXgvWGZmazhaRm1Md284ekxRQTlNUXZrdlc5Y1diTTJ3SndSdDBIMlB0?= =?utf-8?B?Rmw4OXpoWGxqdi9Nd0dUWlJudzFiOVB2SlZyR0IxYytaa05NY0taMkpnbjZH?= =?utf-8?B?QVc2aDYzMEowVW1GL1Vrb1V0Vk5NWGx0bTlGWjdpUkRBSnM3c2lVaFZIOVBq?= =?utf-8?B?ZlpNTnlKa2FiNyt0Znd5STcyWEQ5MG9saHFSTC92UENrQXAyKzNCUkh2dWhC?= =?utf-8?B?bVNaUHZBeGFCT2lYUklJNXI5Ny82V2Jiczl0aC9FNWdhcThrcEJPQXlrS0xu?= =?utf-8?B?TXA0dG03UDZMRFlCMmxhL0RmZk5Va1lqNmtzSHlKTGhtem1oQm16K05HMjZL?= =?utf-8?B?VkV5bWQzMGM3UlR6YkgyWGJsQ2FGVm1RZHNrcUpOb3Q2dkJxczhnWXIxUUVs?= =?utf-8?B?NnVueUlVY3BLSksyVUU1T3BCN0NIdGViNC8yY3ZxOGVWanZ5OUxZWGFtdDB3?= =?utf-8?B?VnRkY0dJVXdYdHBjYkFMQm5oS0VxR3JJTVltY1dDVm1NZS9uQkpnMCtacnJu?= =?utf-8?B?dDY5bDF5ZkJwSkVHVHNKY3dqZWhScW4waVMyNzdnWTd6UFlpS2FBcGpsQ2c5?= =?utf-8?B?Q2FXYnB6RU40Z3JydWJxLzNLMzJkVzNMbjk1Yk4yeWNjRHg5ZGk2ZU1GMVRv?= =?utf-8?B?eUtGbmhJb1hZeVRsQ3FUMnlMYkxBRSswWlhGWEdxdUtGKzQ4TWcreVNreDNN?= =?utf-8?B?ZjJ3UEs5aHFobDJpQjRnejcyam1TR01Ib1Z4MklrbjRTcHo5QTBIR205UkpO?= =?utf-8?B?OTFvOXlab1ZZWC81dWFLbW5TOHhoRENtOGN1T2VWVy9wVVNRcDhEUlV4NERx?= =?utf-8?B?VjZ0ZzBSbFZWQm9PbHFKUlI4cGZTWitQN2pMc05QdnN1djZra2swRnNFTHZV?= =?utf-8?B?cTVkc1F1eUttbjN0U1dFTnVTQTArdmhxT01WTHMwVlRZZWIrTk85SWtHbjhy?= =?utf-8?B?OCs4R3ZTeXV0eStNd2lpRmdGQkQyRU5wR1Q2WEIrSHh5L2dkRVFRQXo3NFM3?= =?utf-8?B?dTlyakZldkFaUy9CTFFWY0gxcTlkeGVlSGpoSWhITUhpaytOenRqUFNLcE5V?= =?utf-8?B?QXJZR1RKYklIYnFTK0JpT0ZGS1ZPV2RCSnVhM1ZjdEFOMzdZT2ZDby9lb3Jq?= =?utf-8?B?cTBUMnRjWUQ5OTVoTVhqUXlwK05ENk42L1lLczkxZzJhc05udEV5bUV0VGpk?= =?utf-8?B?ZVVQb2FmOEhpeFk3UGdXWmdLS0R4R3hSays2U0dyRTBhU1UrazdrZGlrZVV3?= =?utf-8?B?RFNtWS9LclN2T25aeFd0K3NnRjd5dnZJYkpIbTNEamRwOXdoWW8vQ0V0OGV2?= =?utf-8?B?T3ZUejRzTERWb3U5TzNrdy9RUW9nMTNMTjZPRWJoOUdRNVFpSlVNbG45THlK?= =?utf-8?B?MGtPVVZmV2xXYmFzamw0cFRKeVpXRFhSV3BsOHFTS0NNL2pBaWhNYytQdEQ2?= =?utf-8?B?UWppME9uYUJhTjdaVnRUR1Jjd1NHZmhiRWh0RFBHUVVtOElxWHRpT2hENW5W?= =?utf-8?B?NGdBdDIwMUdLZ2tMcjVoelBqL2p2U1duOWpUa0d6L0tMYlJ1dERNWG1Ta0pT?= =?utf-8?B?L2N0VkQ0bjV6Wk9JSmNPOEo4a1ltUlM5V1hKalVpMVhuNldHVG5KbUlyTjB2?= =?utf-8?B?Z3ZOTmJYZm9KUklMQ2JQTWxVNmZkb0tyUXdDRTNvSGR3VC9sd2pCQ3hreDkx?= =?utf-8?B?bk9mUEVoQ3JuVElRQ1J0VnNJakhTUURJNC9STVVIUVdKdGE5MFpnODRxYjdk?= =?utf-8?B?VlhzbW5oeDJOdWM5UGYwZGNRWDlYL2E5UjY5Tm4zTVhhRHQ0ZjBTRndKWlJF?= =?utf-8?Q?el6KlWi3c+SD/umU=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: e565a493-f292-4c78-0445-08df337c16f3 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 26 Oct 2026 16:13:36.5189 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: VyQEElYTgh/5exVDVqA+J0tEMYXFUTOpnqo72gbTncYrt+iqPp63nnI+UJcoLNo9g7fZXpqFOsToL179rHBqVqe19R+b2sVrQvonPYnpoiA= X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR08MB9463 Ack Applied onto hci-dev On 10/26/26 3:03 PM, Denis V. Lunev wrote: > qemu-kvm 8.2.0-11.vl9.71 crashed with SIGSEGV in the memcpy of > scsi_disk_emulate_write_same() on a virtio-scsi iothread (VSTOR-151631, > GMO Cloud). In the core, the WRITE SAME buffer is 20480 bytes, the > size of cmd->xfer computed at parse time, while s->qdev.blocksize is > 65024: the guest raised the block size with a MODE SELECT block > descriptor. virtio_scsi_handle_cmd_vq() parses a whole batch before > submitting it, so a MODE SELECT earlier in the batch changes the block > size after WRITE SAME was sized. When the over-read does not fault, the > QEMU heap past the buffer ends up in the guest's own disk. > > Both patches are clean cherry-picks from upstream master, Cc > qemu-stable and already in stable-10.0, 11.0 and 11.1. Patch 1 bounds > the WRITE SAME read by the allocated buffer. Patch 2 removes the root > cause: a guest can change the block size only on machines that enable > quirk_mode_page_set_block_size, which is only q800. > > The series applies on f3c1d9ef263 independently of the other pending > hci-8.1 patches. Only x86_64 has been build-checked; q800 is not > configured in my build. > > Signed-off-by: Denis V. Lunev > > Paolo Bonzini (2): > scsi-disk: fix out-of-bound read in WRITE SAME #VSTOR-151631 > scsi: hide MODE SELECT block size change behind a quirk #VSTOR-151631 > > hw/m68k/q800.c | 2 ++ > hw/scsi/scsi-disk.c | 17 +++++++++++++---- > include/hw/scsi/scsi.h | 1 + > 3 files changed, 16 insertions(+), 4 deletions(-) > > > base-commit: f3c1d9ef263edfab8d2a273078493bb766dcf8f8