From b5638109062c6bd175534630db1d888abb1f07b7 Mon Sep 17 00:00:00 2001
From: aliguori <aliguori@c046a42c-6fe2-441c-8c8c-71466251a162>
Date: Wed, 28 Jan 2009 21:58:22 +0000
Subject: [PATCH 49/54] fix signed/unsigned overflows in SCSI disk (Rik van Riel)

Sector numbers can overflow on a virtual scsi disk of over 1TB
in size.  Qemu's bdrv_read expects an int64_t, so fix the overflow
by going to that data type.

On large disks, we clip the capacity to 2TB instead of returning
"capacity modulo 2TB".

Turn sector_count into an unsigned to prevent a signed/unsigned
overflow with SCSI transfers larger than 2TB.  We're unlikely to
ever hit this bug, but fixing it is just one line.

Signed-off-by: Rik van Riel <riel@redhat.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Eduardo Habkost <ehabkost@redhat.com>
RH-Upstream-status: applied(qemu), pending(kvm/maint/2.6.29)

git-svn-id: svn://svn.savannah.nongnu.org/qemu/trunk@6467 c046a42c-6fe2-441c-8c8c-71466251a162
---
 qemu/hw/scsi-disk.c |    9 ++++++---
 1 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/qemu/hw/scsi-disk.c b/qemu/hw/scsi-disk.c
index 4c4b921..01dc34b 100644
--- a/qemu/hw/scsi-disk.c
+++ b/qemu/hw/scsi-disk.c
@@ -45,11 +45,11 @@ do { fprintf(stderr, "scsi-disk: " fmt , ##args); } while (0)
 typedef struct SCSIRequest {
     SCSIDeviceState *dev;
     uint32_t tag;
-    /* ??? We should probably keep track of whether the data trasfer is
+    /* ??? We should probably keep track of whether the data transfer is
        a read or a write.  Currently we rely on the host getting it right.  */
     /* Both sector and sector_count are in terms of qemu 512 byte blocks.  */
-    int sector;
-    int sector_count;
+    uint64_t sector;
+    uint32_t sector_count;
     /* The amounnt of data in the buffer.  */
     int buf_len;
     uint8_t *dma_buf;
@@ -680,6 +680,9 @@ static int32_t scsi_send_command(SCSIDevice *d, uint32_t tag,
         /* Returned value is the address of the last sector.  */
         if (nb_sectors) {
             nb_sectors--;
+            /* Clip to 2TB, instead of returning capacity modulo 2TB. */
+            if (nb_sectors > UINT32_MAX)
+                nb_sectors = UINT32_MAX;
             outbuf[0] = (nb_sectors >> 24) & 0xff;
             outbuf[1] = (nb_sectors >> 16) & 0xff;
             outbuf[2] = (nb_sectors >> 8) & 0xff;
-- 
1.6.1