John Millikin fe9d8927e2 scsi: Add buf_len parameter to scsi_req_new()
When a SCSI command is received from the guest, the CDB length implied
by the first byte might exceed the number of bytes the guest sent. In
this case scsi_req_new() will read uninitialized data, causing
unpredictable behavior.

Adds the buf_len parameter to scsi_req_new() and plumbs it through the
call stack.

Signed-off-by: John Millikin <john@john-millikin.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1127
Message-Id: <20220817053458.698416-1-john@john-millikin.com>
[Fill in correct length for adapters other than ESP. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2022-09-01 07:42:37 +02:00
..
2022-06-28 11:06:44 +02:00
2022-08-25 21:59:04 +02:00
2022-08-25 21:59:04 +02:00
2022-08-25 21:59:04 +02:00
2022-08-01 11:58:02 +02:00
2022-08-25 21:59:04 +02:00
2022-06-30 04:49:40 +05:30
2022-08-25 21:59:04 +02:00
2022-04-26 12:25:14 +02:00
2022-07-22 19:01:44 +02:00
2022-06-11 11:44:50 +02:00
2022-06-30 09:21:13 +02:00
2022-06-08 19:38:47 +01:00
2022-07-06 10:22:38 -03:00