@@ -58,6 +58,9 @@
#define TYPE_SCSI_DISK_BASE "scsi-disk-base"
+#define MAX_SERIAL_LEN 36
+#define MAX_SERIAL_LEN_FOR_DEVID 20
+
OBJECT_DECLARE_TYPE(SCSIDiskState, SCSIDiskClass, SCSI_DISK_BASE)
struct SCSIDiskClass {
@@ -648,8 +651,8 @@ static int scsi_disk_emulate_vpd_page(SCSIRequest *req, uint8_t *outbuf)
}
l = strlen(s->serial);
- if (l > 36) {
- l = 36;
+ if (l > MAX_SERIAL_LEN) {
+ l = MAX_SERIAL_LEN;
}
trace_scsi_disk_emulate_vpd_page_80(req->cmd.xfer);
@@ -2501,9 +2504,20 @@ static void scsi_realize(SCSIDevice *dev, Error **errp)
if (!s->vendor) {
s->vendor = g_strdup("QEMU");
}
+ if (s->serial && strlen(s->serial) > MAX_SERIAL_LEN) {
+ error_setg(errp, "The serial number can't be longer than %d characters",
+ MAX_SERIAL_LEN);
+ return;
+ }
if (!s->device_id) {
if (s->serial) {
- s->device_id = g_strdup_printf("%.20s", s->serial);
+ if (strlen(s->serial) > MAX_SERIAL_LEN_FOR_DEVID) {
+ error_setg(errp, "The serial number can't be longer than %d "
+ "characters when it is also used as the default for "
+ "device_id", MAX_SERIAL_LEN_FOR_DEVID);
+ return;
+ }
+ s->device_id = g_strdup(s->serial);
} else {
const char *str = blk_name(s->qdev.conf.blk);
if (str && *str) {
Before this commit, scsi-disk accepts a string of arbitrary length for its "serial" property. However, the value visible on the guest is actually truncated to 36 characters. This limitation doesn't come from the SCSI specification, it is an arbitrary limit that was initially picked as 20 and later bumped to 36 by commit 48b62063. Similarly, device_id was introduced as a copy of the serial number, limited to 20 characters, but commit 48b62063 forgot to actually bump it. As long as we silently truncate the given string, extending the limit is actually not a harmless change, but break the guest ABI. This is the most important reason why commit 48b62063 was really wrong (and it's also why we can't change device_id to be in sync with the serial number again and use 36 characters now, it would be another guest ABI breakage). In order to avoid future breakage, don't silently truncate the serial number string any more, but just error out if it would be truncated. Buglink: https://issues.redhat.com/browse/RHEL-3542 Suggested-by: Peter Krempa <pkrempa@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com> --- hw/scsi/scsi-disk.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-)