[0/5] hw/scsi/spapr_vscsi: Fix time bomb zero-length array use

Message ID	20200304153311.22959-1-philmd@redhat.com (mailing list archive)
Headers	show Return-Path: <SRS0=aN/X=4V=nongnu.org=qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@kernel.org> DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B960E24658 From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <philmd@redhat.com> To: qemu-devel@nongnu.org Subject: [PATCH 0/5] hw/scsi/spapr_vscsi: Fix time bomb zero-length array use Date: Wed, 4 Mar 2020 16:33:06 +0100 Message-Id: <20200304153311.22959-1-philmd@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8; text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: list Cc: Fam Zheng <fam@euphon.net>, qemu-ppc@nongnu.org, Paolo Bonzini <pbonzini@redhat.com>, =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <philmd@redhat.com>, David Gibson <david@gibson.dropbear.id.au> Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" <qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org>
Series	hw/scsi/spapr_vscsi: Fix time bomb zero-length array use \| expand [0/5] hw/scsi/spapr_vscsi: Fix time bomb zero-length array use [1/5] hw/scsi/viosrp: Add missing 'hw/scsi/srp.h' include [2/5] hw/scsi/spapr_vscsi: Use SRP_MAX_IU_LEN instead of sizeof flexible array [3/5] hw/scsi/spapr_vscsi: Simplify a bit [4/5] hw/scsi/spapr_vscsi: Introduce req_ui() helper [5/5] hw/scsi/spapr_vscsi: Do not mix SRP IU size with DMA buffer size

Message ID

20200304153311.22959-1-philmd@redhat.com (mailing list archive)

Headers

DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org B960E24658
From: =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <philmd@redhat.com>
To: qemu-devel@nongnu.org
Subject: [PATCH 0/5] hw/scsi/spapr_vscsi: Fix time bomb zero-length array use
Date: Wed,  4 Mar 2020 16:33:06 +0100
Message-Id: <20200304153311.22959-1-philmd@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8;
	text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Precedence: list
Cc: Fam Zheng <fam@euphon.net>, qemu-ppc@nongnu.org,
 Paolo Bonzini <pbonzini@redhat.com>,
 =?utf-8?q?Philippe_Mathieu-Daud=C3=A9?= <philmd@redhat.com>,
 David Gibson <david@gibson.dropbear.id.au>
Errors-To: 
 qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org
Sender: "Qemu-devel"
 <qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org>

Series

hw/scsi/spapr_vscsi: Fix time bomb zero-length array use | expand

Message

Philippe Mathieu-Daudé March 4, 2020, 3:33 p.m. UTC

This series fixes a dangerous zero-length array use.
Simples patches first to clean the issue in the last patch:
dissociate the buffer holding DMA requests with pointer to
SRP Information Unit packets.

Philippe Mathieu-Daudé (5):
  hw/scsi/viosrp: Add missing 'hw/scsi/srp.h' include
  hw/scsi/spapr_vscsi: Use SRP_MAX_IU_LEN instead of sizeof flexible
    array
  hw/scsi/spapr_vscsi: Simplify a bit
  hw/scsi/spapr_vscsi: Introduce req_ui() helper
  hw/scsi/spapr_vscsi: Do not mix SRP IU size with DMA buffer size

 hw/scsi/viosrp.h      |  4 ++-
 hw/scsi/spapr_vscsi.c | 60 ++++++++++++++++++++++++-------------------
 2 files changed, 37 insertions(+), 27 deletions(-)