From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 10 Jan 2013 14:08:05 +0000 (+0100)
Subject: scsi: fix segfault with 0-byte disk
X-Git-Url: http://git.maquefel.me/?a=commitdiff_plain;h=0369f06f7464e7fb023f103aff889d28e99c43c4;p=qemu.git

scsi: fix segfault with 0-byte disk

When a 0-sized disk is found, READ CAPACITY will return a
LUN NOT READY error.  However, because it returns -1 instead
of zero, the HBA will call scsi_req_continue.  This will
typically cause a segmentation fault or an assertion failure.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---

diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index f8d7ef3374..658e315660 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -1682,7 +1682,7 @@ static int32_t scsi_disk_emulate_command(SCSIRequest *req, uint8_t *buf)
         bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
         if (!nb_sectors) {
             scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
-            return -1;
+            return 0;
         }
         if ((req->cmd.buf[8] & 1) == 0 && req->cmd.lba) {
             goto illegal_request;
@@ -1751,7 +1751,7 @@ static int32_t scsi_disk_emulate_command(SCSIRequest *req, uint8_t *buf)
             bdrv_get_geometry(s->qdev.conf.bs, &nb_sectors);
             if (!nb_sectors) {
                 scsi_check_condition(r, SENSE_CODE(LUN_NOT_READY));
-                return -1;
+                return 0;
             }
             if ((req->cmd.buf[14] & 1) == 0 && req->cmd.lba) {
                 goto illegal_request;