On Thu, Mar 05, 2020 at 01:12:46PM +0100, Philippe Mathieu-Daudé wrote: > This series fixes a possible buffer overflow. > > Simples patches first (dissociate the buffer holding DMA > requests with pointer to SRP Information Unit packets) to > clean the issue in the penultimate patch. >
Applied to ppc-for-5.0, thanks.
> v3:
> - Fixed typo reported by Greg Kurz
> - Addressed Paolo Bonzini review comments as an extra patch
> - Added another patch converting a fprintf() call while here
>
> v2:
> - Addressed David Gibson review comments
>
> Supersedes: <20200305083135.8270-1-phi...@redhat.com>
>
> Philippe Mathieu-Daudé (7):
> hw/scsi/viosrp: Add missing 'hw/scsi/srp.h' include
> hw/scsi/spapr_vscsi: Use SRP_MAX_IU_LEN instead of sizeof flexible
> array
> hw/scsi/spapr_vscsi: Simplify a bit
> hw/scsi/spapr_vscsi: Introduce req_iu() helper
> hw/scsi/spapr_vscsi: Do not mix SRP IU size with DMA buffer size
> hw/scsi/spapr_vscsi: Prevent buffer overflow
> hw/scsi/spapr_vscsi: Convert debug fprintf() to trace event
>
> hw/scsi/viosrp.h | 3 +-
> hw/scsi/spapr_vscsi.c | 72 +++++++++++++++++++++++++------------------
> hw/scsi/trace-events | 1 +
> 3 files changed, 45 insertions(+), 31 deletions(-)
>
--
David Gibson | I'll have my music baroque, and my code
david AT gibson.dropbear.id.au | minimalist, thank you. NOT _the_ _other_
| _way_ _around_!
http://www.ozlabs.org/~dgibson
signature.asc
Description: PGP signature
