SCSI WRITE SAME can copy host heap into the guest disk

Brief

The racing block-size knob is quirked off except on Q800/A/UX.

Notes

Landed on qemu master tip 0a1ebd448b38 via Bonzini for-upstream merge 415436d9d2a8 (previously staging-only HOLD).

Fix: d30254aec931 scsi-disk: fix out-of-bound read in WRITE SAME (Cc: stable)
Quirk: 0f410adf6b0d scsi: hide MODE SELECT block size change behind a quirk (Q800/A/UX only)
Public issue: qemu#4365 (closed, not confidential)
Fixes: 356c4c441ec (2022 MODE SELECT block-size feature)

Author notes virtio-scsi / SG HBAs may not race the same way because they consume WRITE SAME input immediately. Still Cc: stable. Sibling vapic/SMRAM harden in the same merge is a separate card.

Commit d30254aec931

Sources

d30254aec931
0f410adf6b0d
415436d9d2a8
qemu#4365