Hello Alex, +-- On Wed, 25 May 2016, Alexander Graf wrote --+ | > - dma_buf_write((uint8_t *)&info, cmd->iov_size, &cmd->qsg); | > + dma_buf_write((uint8_t *)&info, dcmd_size, &cmd->qsg); | | This looks odd - can dcmd_size be bigger than iov_size? Wouldn't we overwrite | guest memory then? And where does dcmd_size come from? I don't see it in | master.
struct mfi_ctrl_props info; size_t dcmd_size = sizeof(info); -> http://git.qemu.org/?p=qemu.git;a=blob;f=hw/scsi/megasas.c;h=a63a581550a328d0326ddee4f7fe1c4ffdecc194;hb=HEAD#l1439 'dcmd_size' is same as that of 'info' object. -- Prasad J Pandit / Red Hat Product Security Team 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
