On 3/6/20 12:03 AM, David Gibson wrote:
On Thu, Mar 05, 2020 at 01:12:46PM +0100, Philippe Mathieu-Daudé wrote:
This series fixes a possible buffer overflow.
Simples patches first (dissociate the buffer holding DMA
requests with pointer to SRP Information Unit packets) to
clean the issue in the penultimate patch.
Applied to ppc-for-5.0, thanks.
Thanks Paolo and David!
v3:
- Fixed typo reported by Greg Kurz
- Addressed Paolo Bonzini review comments as an extra patch
- Added another patch converting a fprintf() call while here
v2:
- Addressed David Gibson review comments
Supersedes: <20200305083135.8270-1-phi...@redhat.com>
Philippe Mathieu-Daudé (7):
hw/scsi/viosrp: Add missing 'hw/scsi/srp.h' include
hw/scsi/spapr_vscsi: Use SRP_MAX_IU_LEN instead of sizeof flexible
array
hw/scsi/spapr_vscsi: Simplify a bit
hw/scsi/spapr_vscsi: Introduce req_iu() helper
hw/scsi/spapr_vscsi: Do not mix SRP IU size with DMA buffer size
hw/scsi/spapr_vscsi: Prevent buffer overflow
hw/scsi/spapr_vscsi: Convert debug fprintf() to trace event
hw/scsi/viosrp.h | 3 +-
hw/scsi/spapr_vscsi.c | 72 +++++++++++++++++++++++++------------------
hw/scsi/trace-events | 1 +
3 files changed, 45 insertions(+), 31 deletions(-)
