Vmware Paravirtual SCSI emulation uses command descriptors to
process SCSI commands. These come with their message ring buffers.
A guest could set the message ring page count to an arbitrary value
resulting in infinite loop. Add check to avoid it.
Reported-by: YY Z <bigbird475958471@gmail.com>
Signed-off-by: P J P <ppandit@redhat.com>
---
hw/scsi/vmw_pvscsi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index 7557546..4a106da 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -202,7 +202,7 @@ pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri)
uint32_t len_log2;
uint32_t ring_size;
- if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {
+ if (!ri->numPages || ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {
return -1;
}
ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
--
2.9.3
> On 25 Apr 2017, at 16:06 PM, P J P <ppandit@redhat.com> wrote: > > Vmware Paravirtual SCSI emulation uses command descriptors to > process SCSI commands. These come with their message ring buffers. > A guest could set the message ring page count to an arbitrary value > resulting in infinite loop. Add check to avoid it. Hello P J P, Except the commit message that does not exactly correspond to what this patch does, Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Thanks for the patch, Dmitry. > > Reported-by: YY Z <bigbird475958471@gmail.com> > Signed-off-by: P J P <ppandit@redhat.com> > --- > hw/scsi/vmw_pvscsi.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c > index 7557546..4a106da 100644 > --- a/hw/scsi/vmw_pvscsi.c > +++ b/hw/scsi/vmw_pvscsi.c > @@ -202,7 +202,7 @@ pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri) > uint32_t len_log2; > uint32_t ring_size; > > - if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { > + if (!ri->numPages || ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { > return -1; > } > ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE; > -- > 2.9.3 >
On 25/04/2017 17:52, Dmitry Fleytman wrote: > Except the commit message that does not exactly correspond to what this > patch does, > > Reviewed-by: Dmitry Fleytman <dmitry@daynix.com <mailto:dmitry@daynix.com>> Adjusted the commit message and queued. Paolo
+-- On Thu, 27 Apr 2017, Paolo Bonzini wrote --+ | On 25/04/2017 17:52, Dmitry Fleytman wrote: | > Except the commit message that does not exactly correspond to what this | > patch does, | > Reviewed-by: Dmitry Fleytman <dmitry@daynix.com <mailto:dmitry@daynix.com>> | | Adjusted the commit message and queued. Thank you. -- - P J P 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
© 2016 - 2024 Red Hat, Inc.