Commit 1ce27ff81a for qemu.org

commit 1ce27ff81adc64288846a98310236fc86d2f7a58
Author: Stefan Hajnoczi <stefanha@redhat.com>
Date:   Tue Oct 13 14:17:45 2026 -0400

    pr-manager-helper: fix sense buffer overflow

    scsi_build_sense() assumes the sense buffer is SCSI_SENSE_LEN (18) bytes
    long, so the caller's buffer with an arbitrary size cannot be used. Use
    our own sense buffer (resp.sense) as an intermediate buffer and honor
    the caller's sense buffer size (io_hdr->mx_sb_len).

    This is triggered when scsi-generic.c:scsi_SG_IO() calls blk_ioctl()
    with an 8-byte sense buffer. There does not appear to be a way for the
    guest to trigger this buffer overflow directly since
    SCSIRequest->sense[] is 252 bytes long.

    Fixes: 9bad2a6b9d0a ("scsi: add persistent reservation manager using qemu-pr-helper")
    Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
    Reviewed-by: Eric Blake <eblake@redhat.com>
    Link: https://lore.kernel.org/r/20261013181752.1299456-2-stefanha@redhat.com
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

diff --git a/scsi/pr-manager-helper.c b/scsi/pr-manager-helper.c
index 53432e6d60..26ef3876f0 100644
--- a/scsi/pr-manager-helper.c
+++ b/scsi/pr-manager-helper.c
@@ -234,10 +234,11 @@ static int pr_manager_helper_run(PRManager *p,

 out:
     if (ret < 0) {
-        int sense_len = scsi_build_sense(io_hdr->sbp,
+        int sense_len = scsi_build_sense(resp.sense,
                                          SENSE_CODE(LUN_COMM_FAILURE));
         io_hdr->driver_status = SG_ERR_DRIVER_SENSE;
         io_hdr->sb_len_wr = MIN(io_hdr->mx_sb_len, sense_len);
+        memcpy(io_hdr->sbp, resp.sense, io_hdr->sb_len_wr);
         io_hdr->status = CHECK_CONDITION;
     }
     qemu_mutex_unlock(&pr_mgr->lock);