| Message ID | 20170425130623.3649-1-ppandit@redhat.com |
|---|---|
| State | New |
| Headers | show |
> On 25 Apr 2017, at 16:06 PM, P J P <ppandit@redhat.com> wrote: > > Vmware Paravirtual SCSI emulation uses command descriptors to > process SCSI commands. These come with their message ring buffers. > A guest could set the message ring page count to an arbitrary value > resulting in infinite loop. Add check to avoid it. Hello P J P, Except the commit message that does not exactly correspond to what this patch does, Reviewed-by: Dmitry Fleytman <dmitry@daynix.com> Thanks for the patch, Dmitry. > > Reported-by: YY Z <bigbird475958471@gmail.com> > Signed-off-by: P J P <ppandit@redhat.com> > --- > hw/scsi/vmw_pvscsi.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c > index 7557546..4a106da 100644 > --- a/hw/scsi/vmw_pvscsi.c > +++ b/hw/scsi/vmw_pvscsi.c > @@ -202,7 +202,7 @@ pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri) > uint32_t len_log2; > uint32_t ring_size; > > - if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { > + if (!ri->numPages || ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { > return -1; > } > ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE; > -- > 2.9.3 >
On 25/04/2017 17:52, Dmitry Fleytman wrote: > Except the commit message that does not exactly correspond to what this > patch does, > > Reviewed-by: Dmitry Fleytman <dmitry@daynix.com <mailto:dmitry@daynix.com>> Adjusted the commit message and queued. Paolo
+-- On Thu, 27 Apr 2017, Paolo Bonzini wrote --+ | On 25/04/2017 17:52, Dmitry Fleytman wrote: | > Except the commit message that does not exactly correspond to what this | > patch does, | > Reviewed-by: Dmitry Fleytman <dmitry@daynix.com <mailto:dmitry@daynix.com>> | | Adjusted the commit message and queued. Thank you. -- - P J P 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c index 7557546..4a106da 100644 --- a/hw/scsi/vmw_pvscsi.c +++ b/hw/scsi/vmw_pvscsi.c @@ -202,7 +202,7 @@ pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri) uint32_t len_log2; uint32_t ring_size; - if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { + if (!ri->numPages || ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) { return -1; } ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
Vmware Paravirtual SCSI emulation uses command descriptors to process SCSI commands. These come with their message ring buffers. A guest could set the message ring page count to an arbitrary value resulting in infinite loop. Add check to avoid it. Reported-by: YY Z <bigbird475958471@gmail.com> Signed-off-by: P J P <ppandit@redhat.com> --- hw/scsi/vmw_pvscsi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)