Benjamin Herrenschmidt <b...@kernel.crashing.org> writes:
> On Mon, 2013-08-26 at 10:02 +0530, Nikunj A Dadhania wrote:
>
>>
>> From: Nikunj A Dadhania <nik...@linux.vnet.ibm.com>
>>
>> This implements capabilities exchange between host and client.
>> As at the moment no capability is supported, put zero flags everywhere
>> and return.
>>
>> Signed-off-by: Nikunj A Dadhania <nik...@linux.vnet.ibm.com>
>> ---
>> hw/scsi/spapr_vscsi.c | 37 +++++++++++++++++++++++++++++++++++++
>> 1 file changed, 37 insertions(+)
>>
>> diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
>> index e9090e5..fae3644 100644
>> --- a/hw/scsi/spapr_vscsi.c
>> +++ b/hw/scsi/spapr_vscsi.c
>> @@ -858,6 +858,40 @@ static int vscsi_send_adapter_info(VSCSIState *s,
>> vscsi_req *req)
>> return vscsi_send_iu(s, req, sizeof(*sinfo), VIOSRP_MAD_FORMAT);
>> }
>>
>> +static int vscsi_send_capabilities(VSCSIState *s, vscsi_req *req)
>> +{
>> + struct viosrp_capabilities *vcap;
>> + struct capabilities cap;
>> + uint16_t len = 0;
>
> The above initialization isn't useful
>
>> + int rc = true;
>> +
>> + vcap = &req->iu.mad.capabilities;
>> + len = be16_to_cpu(vcap->common.length);
>> + if (len > sizeof(&cap)) {
> ^ Ugh ? Why the & here ?
Oops, got that wrong.
>
>> + fprintf(stderr, "vscsi_send_capabilities: size out of bound !\n");
>> + goto error_out;
>> + }
>
> I am not 100% familiar with the protocol, could it be that we should
> just read sizeof(cap) instead of erroring out or is there no way it
> can be correct and have a len too long ?
If the length is incorrect, can we trust whether cap is correct or is of
the type we are expecting?
