On 05/03/20 13:12, Philippe Mathieu-Daudé wrote: > This series fixes a possible buffer overflow. > > Simples patches first (dissociate the buffer holding DMA > requests with pointer to SRP Information Unit packets) to > clean the issue in the penultimate patch. > > v3: > - Fixed typo reported by Greg Kurz > - Addressed Paolo Bonzini review comments as an extra patch > - Added another patch converting a fprintf() call while here > > v2: > - Addressed David Gibson review comments > > Supersedes: <20200305083135.8270-1-phi...@redhat.com> > > Philippe Mathieu-Daudé (7): > hw/scsi/viosrp: Add missing 'hw/scsi/srp.h' include > hw/scsi/spapr_vscsi: Use SRP_MAX_IU_LEN instead of sizeof flexible > array > hw/scsi/spapr_vscsi: Simplify a bit > hw/scsi/spapr_vscsi: Introduce req_iu() helper > hw/scsi/spapr_vscsi: Do not mix SRP IU size with DMA buffer size > hw/scsi/spapr_vscsi: Prevent buffer overflow > hw/scsi/spapr_vscsi: Convert debug fprintf() to trace event > > hw/scsi/viosrp.h | 3 +- > hw/scsi/spapr_vscsi.c | 72 +++++++++++++++++++++++++------------------ > hw/scsi/trace-events | 1 + > 3 files changed, 45 insertions(+), 31 deletions(-) >
Reviewed-by: Paolo Bonzini <pbonz...@redhat.com>
