On 7/21/26 19:19, Paolo Bonzini wrote:
scsi-disk has a MODE SELECT path where a truncated mode page can be allowed by a compatibility quirk, but the parser continues to use the page's declared length rather than the number of bytes actually remaining in the request buffer. This means that scsi_disk_check_mode_select() and scsi_disk_apply_mode_select() can read beyond the valid part of inbuf[], potentially up to the emulated age's length.Clamping page_len (the size of the page) to len (whatever the guest provided) ensures that scsi_disk_check_mode_select() and scsi_disk_apply_mode_select() do not access anything beyond bounds; however, this requires care to accept and handle truncated input in those two functions. In particular, until scsi_disk_check_mode_select()'s first call to mode_sense_page() the number of bytes to be cleared in mode_current[] is unknown, so zero it completely. And for everything else, be conservative and use len when providing inputs to other functions; but at the same time, ensure all accesses to inbuf[] are bound by expected_len. Note that pages longer than the emulated one are still rejected. Fixes: 389e18eb9aa4 ("scsi-disk: add SCSI_DISK_QUIRK_MODE_PAGE_TRUNCATED quirk for Macintosh") Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4051 Signed-off-by: Paolo Bonzini <[email protected]> --- hw/scsi/scsi-disk.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-)
I'm picking this up for qemu-stable. Please let me know if I shoudn't. Thanks, /mjt
