# DF-4053 — virtio_scsi.c sense memcpy dst/src swap (vs FreeBSD)
# Restore the upstream copy direction (FreeBSD virtio_scsi.c:
#   memcpy(&csio->sense_data, cmd_resp->sense, len)) and bound the
# length to the destination so a malicious device-controlled
# sense_len (up to 4G) combined with an unvalidated pass(4) CCB
# sense_len (up to 255) can never overrun either buffer.
#
# Baseline (buggy):  CHECK CONDITION + CAM_AUTOSNS_VALID + sense_data all 0x00
# Patched  (fixed):  sense 70 00 05 ... (ILLEGAL REQUEST, ASC 21 LBA out of range)
--- a/sys/dev/virtual/virtio/scsi/virtio_scsi.c
+++ b/sys/dev/virtual/virtio/scsi/virtio_scsi.c
@@ -1389,8 +1389,9 @@ vtscsi_complete_scsi_cmd_response(struct vtscsi_softc *sc,
 		else
 			csio->sense_resid = 0;
 
 		bzero(&csio->sense_data, sizeof(csio->sense_data));
-		memcpy(cmd_resp->sense, &csio->sense_data,
-		    csio->sense_len - csio->sense_resid);
+		memcpy(&csio->sense_data, cmd_resp->sense,
+		    MIN(csio->sense_len - csio->sense_resid,
+			sizeof(csio->sense_data)));
 	}
 
 	vtscsi_dprintf(sc, status == CAM_REQ_CMP ? VTSCSI_TRACE : VTSCSI_ERROR,