1f0277483b
- block: bugfix: Don't pause vm when NOSPACE EIO happened - block: enable cache mode of empty cdrom - block/mirror: fix file-system went to read-only after block-mirror - scsi-bus: fix incorrect call for blk_error_retry_reset_timeout() - scsi-bus: fix unmatched object_unref() - block: Add sanity check when setting retry parameters - block-backend: Stop retrying when draining - scsi-disk: Add support for retry on errors - scsi-bus: Refactor the code that retries requests - virtio_blk: Add support for retry on errors - block: Add error retry param setting - block-backend: Add timeout support for retry - block-backend: Enable retry action on errors - block-backend: Add device specific retry callback - block-backend: Introduce retry timer - qapi/block-core: Add retry option for error action - scsi: bugfix: fix division by zero - scsi: cdrom: Fix crash after remote cdrom detached - qemu-pr: fixed ioctl failed for multipath disk - scsi-disk: define props in scsi_block_disk to avoid memleaks - bugfix: fix possible memory leak - bugfix: fix some illegal memory access and memory leak - util/log: add CONFIG_DISABLE_QEMU_LOG macro - log: Add some logs on VM runtime path - bugfix: fix eventfds may double free when vm_id reused in ivshmem - hw/display/macfb: Fix missing ERRP_GUARD() in macfb_nubus_realize() - hw/cxl/cxl-host: Fix missing ERRP_GUARD() in cxl_fixed_memory_window_config() - qemu-img create: 'cache' paramter only use for reg file image - qemu-img: add qemu-img direct create - qemu-img block: set zero flags only when discard_zeros of the block supported - Revert "file-posix: Remove unused s->discard_zeroes" - pcie_sriov: Validate NumVFs (CVE-2024-26327) - hw/nvme: Use pcie_sriov_num_vfs() (CVE-2024-26328) - hw/acpi/cpu: Use CPUState typedef - target/i386/sev: Fix missing ERRP_GUARD() for error_prepend() - virtio-gpu: remove needless condition - hw/i2c/smbus_slave: Add object path on error prints - vfio/pci: Ascend710 change to bar2 quirk - vfio/pci: Ascend910 need 4Bytes quirk in bar0 - vfio/pci: Ascend710 need 4Bytes quirk in bar0 - vfio/pci: Ascend310 need 4Bytes quirk in bar4 - chardev/char-socket: Fix TLS io channels sending too much data to the backend - i386/cpuid: Move leaf 7 to correct group - i386/cpuid: Decrease cpuid_i when skipping CPUID leaf 1F - i386/cpu: Mask with XCR0/XSS mask for FEAT_XSAVE_XCR0_HI and FEAT_XSAVE_XSS_HI leafs - i386/cpu: Clear FEAT_XSAVE_XSS_LO/HI leafs when CPUID_EXT_XSAVE is not available - blkio: Respect memory-alignment for bounce buffer allocations - virtio-gpu: Correct virgl_renderer_resource_get_info() error check - hw/usb: Style cleanup - tests/qemu-iotests: resolved the problem that the 108 test cases in the container fail Signed-off-by: Jiabo Feng <fengjiabo1@huawei.com> (cherry picked from commit 404d45bf9147058a475a8031c454a6c8e0acc123)
59 lines
2.4 KiB
Diff
59 lines
2.4 KiB
Diff
From f2837d186532fb82ed01dbe32bdcf9dda6b06258 Mon Sep 17 00:00:00 2001
|
|
From: WangJian <wangjian161@huawei.com>
|
|
Date: Wed, 9 Feb 2022 16:34:05 +0800
|
|
Subject: [PATCH] scsi: bugfix: fix division by zero
|
|
|
|
Error of PRDM disk may cause divide by zero in
|
|
scsi_read_complete(), so add LOG and assert().
|
|
|
|
Signed-off-by: wangjian161 <wangjian161@huawei.com>
|
|
Signed-off-by: shaodenghui <shaodenghui@huawei.com>
|
|
---
|
|
hw/scsi/scsi-generic.c | 20 ++++++++++++++++++--
|
|
1 file changed, 18 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
|
|
index 2417f0ad84..22efcd09a6 100644
|
|
--- a/hw/scsi/scsi-generic.c
|
|
+++ b/hw/scsi/scsi-generic.c
|
|
@@ -192,6 +192,10 @@ static int scsi_handle_inquiry_reply(SCSIGenericReq *r, SCSIDevice *s, int len)
|
|
(r->req.cmd.buf[1] & 0x01)) {
|
|
page = r->req.cmd.buf[2];
|
|
if (page == 0xb0 && r->buflen >= 8) {
|
|
+ if (s->blocksize == 0) {
|
|
+ qemu_log("device blocksize is 0!\n");
|
|
+ abort();
|
|
+ }
|
|
uint8_t buf[16] = {};
|
|
uint8_t buf_used = MIN(r->buflen, 16);
|
|
uint64_t max_transfer = calculate_max_transfer(s);
|
|
@@ -326,11 +330,23 @@ static void scsi_read_complete(void * opaque, int ret)
|
|
/* Snoop READ CAPACITY output to set the blocksize. */
|
|
if (r->req.cmd.buf[0] == READ_CAPACITY_10 &&
|
|
(ldl_be_p(&r->buf[0]) != 0xffffffffU || s->max_lba == 0)) {
|
|
- s->blocksize = ldl_be_p(&r->buf[4]);
|
|
+ int new_blocksize = ldl_be_p(&r->buf[4]);
|
|
+ if (s->blocksize != new_blocksize) {
|
|
+ qemu_log("device id=%s type=%d: blocksize %d change to %d\n",
|
|
+ s->qdev.id ? s->qdev.id : "null", s->type,
|
|
+ s->blocksize, new_blocksize);
|
|
+ }
|
|
+ s->blocksize = new_blocksize;
|
|
s->max_lba = ldl_be_p(&r->buf[0]) & 0xffffffffULL;
|
|
} else if (r->req.cmd.buf[0] == SERVICE_ACTION_IN_16 &&
|
|
(r->req.cmd.buf[1] & 31) == SAI_READ_CAPACITY_16) {
|
|
- s->blocksize = ldl_be_p(&r->buf[8]);
|
|
+ int new_blocksize = ldl_be_p(&r->buf[8]);
|
|
+ if (s->blocksize != new_blocksize) {
|
|
+ qemu_log("device id=%s type=%d: blocksize %d change to %d\n",
|
|
+ s->qdev.id ? s->qdev.id : "null", s->type,
|
|
+ s->blocksize, new_blocksize);
|
|
+ }
|
|
+ s->blocksize = new_blocksize;
|
|
s->max_lba = ldq_be_p(&r->buf[0]);
|
|
}
|
|
|
|
--
|
|
2.27.0
|
|
|