From: Stefan Hajnoczi <[email protected]>
scsi_build_sense() assumes the sense buffer is SCSI_SENSE_LEN (18) bytes
long, so the caller's buffer with an arbitrary size cannot be used. Use
our own sense buffer (resp.sense) as an intermediate buffer and honor
the caller's sense buffer size (io_hdr->mx_sb_len).
This is triggered when scsi-generic.c:scsi_SG_IO() calls blk_ioctl()
with an 8-byte sense buffer. There does not appear to be a way for the
guest to trigger this buffer overflow directly since
SCSIRequest->sense[] is 252 bytes long.
Fixes: 9bad2a6b9d0a ("scsi: add persistent reservation manager using
qemu-pr-helper")
Signed-off-by: Stefan Hajnoczi <[email protected]>
Reviewed-by: Eric Blake <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Paolo Bonzini <[email protected]>
---
scsi/pr-manager-helper.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/scsi/pr-manager-helper.c b/scsi/pr-manager-helper.c
index 53432e6d606..26ef3876f0e 100644
--- a/scsi/pr-manager-helper.c
+++ b/scsi/pr-manager-helper.c
@@ -234,10 +234,11 @@ static int pr_manager_helper_run(PRManager *p,
out:
if (ret < 0) {
- int sense_len = scsi_build_sense(io_hdr->sbp,
+ int sense_len = scsi_build_sense(resp.sense,
SENSE_CODE(LUN_COMM_FAILURE));
io_hdr->driver_status = SG_ERR_DRIVER_SENSE;
io_hdr->sb_len_wr = MIN(io_hdr->mx_sb_len, sense_len);
+ memcpy(io_hdr->sbp, resp.sense, io_hdr->sb_len_wr);
io_hdr->status = CHECK_CONDITION;
}
qemu_mutex_unlock(&pr_mgr->lock);
--
2.56.0
