| Message ID | 20200304153311.22959-4-philmd@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | hw/scsi/spapr_vscsi: Fix time bomb zero-length array use | expand |
On Wed, Mar 04, 2020 at 04:33:09PM +0100, Philippe Mathieu-Daudé wrote: > We already have a ui pointer, use it (to simplify the next commit). > > Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Applied to ppc-for-5.0. > --- > hw/scsi/spapr_vscsi.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c > index 7e397ed797..3cb5a38181 100644 > --- a/hw/scsi/spapr_vscsi.c > +++ b/hw/scsi/spapr_vscsi.c > @@ -261,9 +261,9 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req, > if (status) { > iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2; > if (req->senselen) { > - req->iu.srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID; > - req->iu.srp.rsp.sense_data_len = cpu_to_be32(req->senselen); > - memcpy(req->iu.srp.rsp.data, req->sense, req->senselen); > + iu->srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID; > + iu->srp.rsp.sense_data_len = cpu_to_be32(req->senselen); > + memcpy(iu->srp.rsp.data, req->sense, req->senselen); > total_len += req->senselen; > } > } else {
On Wed, 4 Mar 2020 16:33:09 +0100 Philippe Mathieu-Daudé <philmd@redhat.com> wrote: > We already have a ui pointer, use it (to simplify the next commit). > Small typo, s/ui/iu > Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> > --- > hw/scsi/spapr_vscsi.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c > index 7e397ed797..3cb5a38181 100644 > --- a/hw/scsi/spapr_vscsi.c > +++ b/hw/scsi/spapr_vscsi.c > @@ -261,9 +261,9 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req, > if (status) { > iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2; > if (req->senselen) { > - req->iu.srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID; > - req->iu.srp.rsp.sense_data_len = cpu_to_be32(req->senselen); > - memcpy(req->iu.srp.rsp.data, req->sense, req->senselen); > + iu->srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID; > + iu->srp.rsp.sense_data_len = cpu_to_be32(req->senselen); > + memcpy(iu->srp.rsp.data, req->sense, req->senselen); > total_len += req->senselen; > } > } else {
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c index 7e397ed797..3cb5a38181 100644 --- a/hw/scsi/spapr_vscsi.c +++ b/hw/scsi/spapr_vscsi.c @@ -261,9 +261,9 @@ static int vscsi_send_rsp(VSCSIState *s, vscsi_req *req, if (status) { iu->srp.rsp.sol_not = (sol_not & 0x04) >> 2; if (req->senselen) { - req->iu.srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID; - req->iu.srp.rsp.sense_data_len = cpu_to_be32(req->senselen); - memcpy(req->iu.srp.rsp.data, req->sense, req->senselen); + iu->srp.rsp.flags |= SRP_RSP_FLAG_SNSVALID; + iu->srp.rsp.sense_data_len = cpu_to_be32(req->senselen); + memcpy(iu->srp.rsp.data, req->sense, req->senselen); total_len += req->senselen; } } else {
We already have a ui pointer, use it (to simplify the next commit). Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> --- hw/scsi/spapr_vscsi.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)