3a13ddd514
CVE-2016-7156: pvscsi: infinite loop when building SG list (bz #1373480) CVE-2016-7156: pvscsi: infinite loop when processing IO requests (bz #1373480) CVE-2016-7170: vmware_vga: OOB stack memory access (bz #1374709) CVE-2016-7157: mptsas: invalid memory access (bz #1373505) CVE-2016-7466: usb: xhci memory leakage during device unplug (bz #1377838) CVE-2016-7423: scsi: mptsas: OOB access (bz #1376777) CVE-2016-7422: virtio: null pointer dereference (bz #1376756) CVE-2016-7908: net: Infinite loop in mcf_fec_do_tx (bz #1381193) CVE-2016-8576: usb: xHCI: infinite loop vulnerability (bz #1382322) CVE-2016-7995: usb: hcd-ehci: memory leak (bz #1382669)
62 lines
2.5 KiB
Diff
62 lines
2.5 KiB
Diff
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Date: Tue, 6 Sep 2016 02:20:43 +0530
|
|
Subject: [PATCH] scsi: pvscsi: limit loop to fetch SG list
|
|
|
|
In PVSCSI paravirtual SCSI bus, pvscsi_convert_sglist can take a very
|
|
long time or go into an infinite loop due to two different bugs:
|
|
|
|
1) the request descriptor data length is defined to be 64 bit. While
|
|
building SG list from a request descriptor, it gets truncated to 32bit
|
|
in routine 'pvscsi_convert_sglist'. This could lead to an infinite loop
|
|
situation large 'dataLen' values when data_length is cast to uint32_t and
|
|
chunk_size becomes always zero. Fix this by removing the incorrect cast.
|
|
|
|
2) pvscsi_get_next_sg_elem can be called arbitrarily many times if the
|
|
element has a zero length. Get out of the loop early when this happens,
|
|
by introducing an upper limit on the number of SG list elements.
|
|
|
|
Reported-by: Li Qiang <liqiang6-s@360.cn>
|
|
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
Message-Id: <1473108643-12983-1-git-send-email-ppandit@redhat.com>
|
|
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
(cherry picked from commit 49adc5d3f8c6bb75e55ebfeab109c5c37dea65e8)
|
|
---
|
|
hw/scsi/vmw_pvscsi.c | 11 ++++++-----
|
|
1 file changed, 6 insertions(+), 5 deletions(-)
|
|
|
|
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
|
|
index 4245c15..babac5a 100644
|
|
--- a/hw/scsi/vmw_pvscsi.c
|
|
+++ b/hw/scsi/vmw_pvscsi.c
|
|
@@ -40,6 +40,8 @@
|
|
#define PVSCSI_MAX_DEVS (64)
|
|
#define PVSCSI_MSIX_NUM_VECTORS (1)
|
|
|
|
+#define PVSCSI_MAX_SG_ELEM 2048
|
|
+
|
|
#define PVSCSI_MAX_CMD_DATA_WORDS \
|
|
(sizeof(PVSCSICmdDescSetupRings)/sizeof(uint32_t))
|
|
|
|
@@ -628,17 +630,16 @@ pvscsi_queue_pending_descriptor(PVSCSIState *s, SCSIDevice **d,
|
|
static void
|
|
pvscsi_convert_sglist(PVSCSIRequest *r)
|
|
{
|
|
- int chunk_size;
|
|
+ uint32_t chunk_size, elmcnt = 0;
|
|
uint64_t data_length = r->req.dataLen;
|
|
PVSCSISGState sg = r->sg;
|
|
- while (data_length) {
|
|
- while (!sg.resid) {
|
|
+ while (data_length && elmcnt < PVSCSI_MAX_SG_ELEM) {
|
|
+ while (!sg.resid && elmcnt++ < PVSCSI_MAX_SG_ELEM) {
|
|
pvscsi_get_next_sg_elem(&sg);
|
|
trace_pvscsi_convert_sglist(r->req.context, r->sg.dataAddr,
|
|
r->sg.resid);
|
|
}
|
|
- assert(data_length > 0);
|
|
- chunk_size = MIN((unsigned) data_length, sg.resid);
|
|
+ chunk_size = MIN(data_length, sg.resid);
|
|
if (chunk_size) {
|
|
qemu_sglist_add(&r->sgl, sg.dataAddr, chunk_size);
|
|
}
|