| Message ID | 1391017659-5506-1-git-send-email-armbru@redhat.com |
|---|---|
| State | New |
| Headers | show |
Il 29/01/2014 18:47, Markus Armbruster ha scritto: > The transfer length depends on field BYTCHK, which is encoded in byte > 1, bits 1..2. However, the guard for for case BYTCHK=11b doesn't > work, and we get case 01b instead. Fix it. > > Note that since emulated scsi-hd fails the command outright, it takes > SCSI passthrough of a device that actually implements VERIFY with > BYTCHK=11b to make the bug bite. > > Screwed up in commit d12ad44. Spotted by Coverity. > > Signed-off-by: Markus Armbruster <armbru@redhat.com> > --- > hw/scsi/scsi-bus.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c > index 50b89ad..285a58b 100644 > --- a/hw/scsi/scsi-bus.c > +++ b/hw/scsi/scsi-bus.c > @@ -909,7 +909,7 @@ static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) > case VERIFY_16: > if ((buf[1] & 2) == 0) { > cmd->xfer = 0; > - } else if ((buf[1] & 4) == 1) { > + } else if ((buf[1] & 4) != 0) { > cmd->xfer = 1; > } > cmd->xfer *= dev->blocksize; > Applied to scsi-next, thanks. Paolo
Ping? Markus Armbruster <armbru@redhat.com> writes: > The transfer length depends on field BYTCHK, which is encoded in byte > 1, bits 1..2. However, the guard for for case BYTCHK=11b doesn't > work, and we get case 01b instead. Fix it. > > Note that since emulated scsi-hd fails the command outright, it takes > SCSI passthrough of a device that actually implements VERIFY with > BYTCHK=11b to make the bug bite. > > Screwed up in commit d12ad44. Spotted by Coverity. > > Signed-off-by: Markus Armbruster <armbru@redhat.com> > --- > hw/scsi/scsi-bus.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c > index 50b89ad..285a58b 100644 > --- a/hw/scsi/scsi-bus.c > +++ b/hw/scsi/scsi-bus.c > @@ -909,7 +909,7 @@ static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) > case VERIFY_16: > if ((buf[1] & 2) == 0) { > cmd->xfer = 0; > - } else if ((buf[1] & 4) == 1) { > + } else if ((buf[1] & 4) != 0) { > cmd->xfer = 1; > } > cmd->xfer *= dev->blocksize;
Il 24/02/2014 14:07, Markus Armbruster ha scritto:
> Ping?
The pull request depends on Kevin's block patches, so I need to wait for
that one to get in.
Paolo
diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c index 50b89ad..285a58b 100644 --- a/hw/scsi/scsi-bus.c +++ b/hw/scsi/scsi-bus.c @@ -909,7 +909,7 @@ static int scsi_req_length(SCSICommand *cmd, SCSIDevice *dev, uint8_t *buf) case VERIFY_16: if ((buf[1] & 2) == 0) { cmd->xfer = 0; - } else if ((buf[1] & 4) == 1) { + } else if ((buf[1] & 4) != 0) { cmd->xfer = 1; } cmd->xfer *= dev->blocksize;
The transfer length depends on field BYTCHK, which is encoded in byte 1, bits 1..2. However, the guard for for case BYTCHK=11b doesn't work, and we get case 01b instead. Fix it. Note that since emulated scsi-hd fails the command outright, it takes SCSI passthrough of a device that actually implements VERIFY with BYTCHK=11b to make the bug bite. Screwed up in commit d12ad44. Spotted by Coverity. Signed-off-by: Markus Armbruster <armbru@redhat.com> --- hw/scsi/scsi-bus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)