[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 19/56] block/iscsi: avoid potential overflow of acb-
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 19/56] block/iscsi: avoid potential overflow of acb->task->cdb |
Date: |
Mon, 8 Aug 2016 16:03:50 -0500 |
From: Peter Lieven <address@hidden>
at least in the path via virtio-blk the maximum size is not
restricted.
Cc: address@hidden
Signed-off-by: Peter Lieven <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit a6b3167fa0e825aebb5a7cd8b437b6d41584a196)
Signed-off-by: Michael Roth <address@hidden>
---
block/iscsi.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/block/iscsi.c b/block/iscsi.c
index 302baf8..172e6cf 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -837,6 +837,13 @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
return &acb->common;
}
+ if (acb->ioh->cmd_len > SCSI_CDB_MAX_SIZE) {
+ error_report("iSCSI: ioctl error CDB exceeds max size (%d > %d)",
+ acb->ioh->cmd_len, SCSI_CDB_MAX_SIZE);
+ qemu_aio_unref(acb);
+ return NULL;
+ }
+
acb->task = malloc(sizeof(struct scsi_task));
if (acb->task == NULL) {
error_report("iSCSI: Failed to allocate task for scsi command. %s",
--
1.9.1
- [Qemu-devel] [PATCH 12/56] json-streamer: fix double-free on exiting during a parse, (continued)
- [Qemu-devel] [PATCH 12/56] json-streamer: fix double-free on exiting during a parse, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 13/56] esp: check command buffer length before write(CVE-2016-4439), Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 15/56] block/nfs: refuse readahead if cache.direct is on, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 16/56] usb/ohci: Fix crash with when specifying too many num-ports, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 17/56] vga: add sr_vbe register set, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 14/56] esp: check dma length before reading scsi command(CVE-2016-4441), Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 22/56] Fix configure test for PBKDF2 in nettle, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 18/56] vfio: Fix broken EEH, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 20/56] nbd: Don't trim unrequested bytes, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 01/56] i386: kvmvapic: initialise imm32 variable, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 19/56] block/iscsi: avoid potential overflow of acb->task->cdb,
Michael Roth <=
- [Qemu-devel] [PATCH 27/56] vmsvga: add more fifo checks, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 21/56] savevm: fail if migration blockers are present, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 24/56] scsi: mptsas: infinite loop while fetching requests, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 30/56] io: remove mistaken call to object_ref on QTask, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 23/56] scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952), Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 29/56] vmsvga: don't process more than 1024 fifo commands at once, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 31/56] ui: fix regression in printing VNC host/port on startup, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 32/56] net: fix qemu_announce_self not emitting packets, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 25/56] block: Drop bdrv_ioctl_bh_cb, Michael Roth, 2016/08/08
- [Qemu-devel] [PATCH 26/56] vmsvga: move fifo sanity checks to vmsvga_fifo_length, Michael Roth, 2016/08/08