From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 10 Jun 2014 14:53:39 +0000 (+0200)
Subject: virtio-scsi: add target swap for VirtIOSCSICtrlTMFReq fields
X-Git-Tag: qemu-xen-4.6.0-rc1~374^2~8
X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=b0b4ea17dc7572ca79b2bb54447de5333dada5b2;p=qemu-upstream-4.6-testing.git

virtio-scsi: add target swap for VirtIOSCSICtrlTMFReq fields

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---

diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index f013e35d6..ec9a5362f 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -207,6 +207,7 @@ static void virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
     /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE".  */
     req->resp.tmf->response = VIRTIO_SCSI_S_OK;
 
+    tswap32s(&req->req.tmf->subtype);
     switch (req->req.tmf->subtype) {
     case VIRTIO_SCSI_T_TMF_ABORT_TASK:
     case VIRTIO_SCSI_T_TMF_QUERY_TASK:
@@ -314,8 +315,11 @@ static void virtio_scsi_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq)
         if (iov_to_buf(req->elem.out_sg, req->elem.out_num, 0,
                        &type, sizeof(type)) < sizeof(type)) {
             virtio_scsi_bad_req();
+            continue;
+        }
 
-        } else if (req->req.tmf->type == VIRTIO_SCSI_T_TMF) {
+        tswap32s(&req->req.tmf->type);
+        if (req->req.tmf->type == VIRTIO_SCSI_T_TMF) {
             if (virtio_scsi_parse_req(req, sizeof(VirtIOSCSICtrlTMFReq),
                                       sizeof(VirtIOSCSICtrlTMFResp)) < 0) {
                 virtio_scsi_bad_req();