On Wed, Dec 20, 2017 at 06:14:44PM +0100, Paolo Bonzini wrote:
> @@ -274,52 +319,21 @@ const struct SCSISense sense_code_SPACE_ALLOC_FAILED = {
> int scsi_convert_sense(uint8_t *in_buf, int in_len,
> uint8_t *buf, int len, bool fixed)
> {
> - bool fixed_in;
> SCSISense sense;
> - if (!fixed && len < 8) {
> - return 0;
> - }
> -
> - if (in_len == 0) {
> - sense.key = NO_SENSE;
> - sense.asc = 0;
> - sense.ascq = 0;
> - } else {
> - fixed_in = (in_buf[0] & 2) == 0;
> -
> - if (fixed == fixed_in) {
> - memcpy(buf, in_buf, MIN(len, in_len));
> - return MIN(len, in_len);
> - }
> + bool fixed_in;
>
> - if (fixed_in) {
> - sense.key = in_buf[2];
> - sense.asc = in_buf[12];
> - sense.ascq = in_buf[13];
> - } else {
> - sense.key = in_buf[1];
> - sense.asc = in_buf[2];
> - sense.ascq = in_buf[3];
> - }
> + fixed_in = (in_buf[0] & 2) == 0;
> + if (in_len && fixed == fixed_in) {
> + memcpy(buf, in_buf, MIN(len, in_len));
> + return MIN(len, in_len);
This reliably segfaults with any scsi disk because
scsi_disk_emulate_command passes in_buf=NULL here:
case REQUEST_SENSE:
/* Just return "NO SENSE". */
buflen = scsi_convert_sense(NULL, 0, outbuf, r->buflen,
(req->cmd.buf[1] & 1) == 0);
Roman.
