[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 43/77] scsi-generic: avoid possible out-of-bounds acc
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 43/77] scsi-generic: avoid possible out-of-bounds access to r->buf |
Date: |
Mon, 4 Feb 2019 19:35:45 +0100 |
Whenever the allocation length of a SCSI request is shorter than the size of the
VPD page list, page_idx is used blindly to index into r->buf. Even though
the stores in the insertion sort are protected against overflows, the same is
not
true of the reads and the final store of 0xb0.
This basically does the same thing as commit 57dbb58d80 ("scsi-generic: avoid
out-of-bounds access to VPD page list", 2018-11-06), except that here the
allocation length can be chosen by the guest. Note that according to the SCSI
standard, the contents of the PAGE LENGTH field are not altered based
on the allocation length.
The code was introduced by commit 6c219fc8a1 ("scsi-generic: keep VPD
page list sorted", 2018-11-06) but the overflow was already possible before.
Reported-by: Kevin Wolf <address@hidden>
Fixes: a71c775b24ebc664129eb1d9b4c360590353efd5
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/scsi/scsi-generic.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
index 7237b41..42700e8 100644
--- a/hw/scsi/scsi-generic.c
+++ b/hw/scsi/scsi-generic.c
@@ -182,7 +182,7 @@ static void scsi_handle_inquiry_reply(SCSIGenericReq *r,
SCSIDevice *s)
/* Also take care of the opt xfer len. */
stl_be_p(&r->buf[12],
MIN_NON_ZERO(max_transfer, ldl_be_p(&r->buf[12])));
- } else if (s->needs_vpd_bl_emulation && page == 0x00) {
+ } else if (s->needs_vpd_bl_emulation && page == 0x00 && r->buflen >=
4) {
/*
* Now we're capable of supplying the VPD Block Limits
* response if the hardware can't. Add it in the INQUIRY
@@ -193,18 +193,20 @@ static void scsi_handle_inquiry_reply(SCSIGenericReq *r,
SCSIDevice *s)
* and will use it to proper setup the SCSI device.
*
* VPD page numbers must be sorted, so insert 0xb0 at the
- * right place with an in-place insert. After the initialization
- * part of the for loop is executed, the device response is
- * at r[0] to r[page_idx - 1].
+ * right place with an in-place insert. When the while loop
+ * begins the device response is at r[0] to r[page_idx - 1].
*/
- for (page_idx = lduw_be_p(r->buf + 2) + 4;
- page_idx > 4 && r->buf[page_idx - 1] >= 0xb0;
- page_idx--) {
+ page_idx = lduw_be_p(r->buf + 2) + 4;
+ page_idx = MIN(page_idx, r->buflen);
+ while (page_idx > 4 && r->buf[page_idx - 1] >= 0xb0) {
if (page_idx < r->buflen) {
r->buf[page_idx] = r->buf[page_idx - 1];
}
+ page_idx--;
+ }
+ if (page_idx < r->buflen) {
+ r->buf[page_idx] = 0xb0;
}
- r->buf[page_idx] = 0xb0;
stw_be_p(r->buf + 2, lduw_be_p(r->buf + 2) + 1);
}
}
--
1.8.3.1
- [Qemu-devel] [PULL 15/77] pvh: Boot uncompressed kernel using direct boot ABI, (continued)
- [Qemu-devel] [PULL 15/77] pvh: Boot uncompressed kernel using direct boot ABI, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 37/77] hw/core/loader.c: Read as long as possible in load_image_size(), Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 40/77] docker: adjust Xen repository for CentOS 7, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 33/77] monitor: do not use QTAILQ_FOREACH_SAFE across critical sections, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 38/77] i386: import & use bootparam.h, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 36/77] unify len and addr type for memory/address APIs, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 34/77] crypto: finish removing TABs, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 39/77] i386: allow to load initrd below 4 GB for recent linux, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 35/77] ui: vnc: finish removing TABs, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 41/77] i386: hvf: Don't miss 16-bit displacement, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 43/77] scsi-generic: avoid possible out-of-bounds access to r->buf,
Paolo Bonzini <=
- [Qemu-devel] [PULL 42/77] gdbstub: Fix i386/x86_64 machine description and add control registers, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 48/77] vfio: move conditional up to hw/Makefile.objs, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 44/77] Remove deprecated -enable-hax option, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 46/77] arm: disable CONFIG_SERIAL_ISA, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 49/77] hw/pci-host/Makefile.objs: make CONFIGS clear for PCI EXPRESS, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 47/77] ide: split ioport registration to a separate file, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 45/77] qemu-options: Remove deprecated "-virtioconsole" option, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 50/77] build: actually use CONFIG_PAM, Paolo Bonzini, 2019/02/04
- [Qemu-devel] [PULL 51/77] hw/i386/Makefile.objs: Build pc_piix* and pc_q35 boards, Paolo Bonzini, 2019/02/04