[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH 54/55] scsi: lsi: exit infinite loop while executing script (CVE-
From: |
Michael Roth |
Subject: |
[PATCH 54/55] scsi: lsi: exit infinite loop while executing script (CVE-2019-12068) |
Date: |
Tue, 5 Nov 2019 14:52:42 -0600 |
From: Paolo Bonzini <address@hidden>
When executing script in lsi_execute_script(), the LSI scsi adapter
emulator advances 's->dsp' index to read next opcode. This can lead
to an infinite loop if the next opcode is empty. Move the existing
loop exit after 10k iterations so that it covers no-op opcodes as
well.
Reported-by: Bugs SysSec <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit de594e47659029316bbf9391efb79da0a1a08e08)
Signed-off-by: Michael Roth <address@hidden>
---
hw/scsi/lsi53c895a.c | 41 +++++++++++++++++++++++++++--------------
1 file changed, 27 insertions(+), 14 deletions(-)
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index 10468c1ec1..72f7b59ab5 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -185,6 +185,9 @@ static const char *names[] = {
/* Flag set if this is a tagged command. */
#define LSI_TAG_VALID (1 << 16)
+/* Maximum instructions to process. */
+#define LSI_MAX_INSN 10000
+
typedef struct lsi_request {
SCSIRequest *req;
uint32_t tag;
@@ -1132,7 +1135,21 @@ static void lsi_execute_script(LSIState *s)
s->istat1 |= LSI_ISTAT1_SRUN;
again:
- insn_processed++;
+ if (++insn_processed > LSI_MAX_INSN) {
+ /* Some windows drivers make the device spin waiting for a memory
+ location to change. If we have been executed a lot of code then
+ assume this is the case and force an unexpected device disconnect.
+ This is apparently sufficient to beat the drivers into submission.
+ */
+ if (!(s->sien0 & LSI_SIST0_UDC)) {
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "lsi_scsi: inf. loop with UDC masked");
+ }
+ lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
+ lsi_disconnect(s);
+ trace_lsi_execute_script_stop();
+ return;
+ }
insn = read_dword(s, s->dsp);
if (!insn) {
/* If we receive an empty opcode increment the DSP by 4 bytes
@@ -1569,19 +1586,7 @@ again:
}
}
}
- if (insn_processed > 10000 && s->waiting == LSI_NOWAIT) {
- /* Some windows drivers make the device spin waiting for a memory
- location to change. If we have been executed a lot of code then
- assume this is the case and force an unexpected device disconnect.
- This is apparently sufficient to beat the drivers into submission.
- */
- if (!(s->sien0 & LSI_SIST0_UDC)) {
- qemu_log_mask(LOG_GUEST_ERROR,
- "lsi_scsi: inf. loop with UDC masked");
- }
- lsi_script_scsi_interrupt(s, LSI_SIST0_UDC, 0);
- lsi_disconnect(s);
- } else if (s->istat1 & LSI_ISTAT1_SRUN && s->waiting == LSI_NOWAIT) {
+ if (s->istat1 & LSI_ISTAT1_SRUN && s->waiting == LSI_NOWAIT) {
if (s->dcntl & LSI_DCNTL_SSM) {
lsi_script_dma_interrupt(s, LSI_DSTAT_SSI);
} else {
@@ -1969,6 +1974,10 @@ static void lsi_reg_writeb(LSIState *s, int offset,
uint8_t val)
case 0x2f: /* DSP[24:31] */
s->dsp &= 0x00ffffff;
s->dsp |= val << 24;
+ /*
+ * FIXME: if s->waiting != LSI_NOWAIT, this will only execute one
+ * instruction. Is this correct?
+ */
if ((s->dmode & LSI_DMODE_MAN) == 0
&& (s->istat1 & LSI_ISTAT1_SRUN) == 0)
lsi_execute_script(s);
@@ -1987,6 +1996,10 @@ static void lsi_reg_writeb(LSIState *s, int offset,
uint8_t val)
break;
case 0x3b: /* DCNTL */
s->dcntl = val & ~(LSI_DCNTL_PFF | LSI_DCNTL_STD);
+ /*
+ * FIXME: if s->waiting != LSI_NOWAIT, this will only execute one
+ * instruction. Is this correct?
+ */
if ((val & LSI_DCNTL_STD) && (s->istat1 & LSI_ISTAT1_SRUN) == 0)
lsi_execute_script(s);
break;
--
2.17.1
- [PATCH 08/55] block/file-posix: Reduce xfsctl() use, (continued)
- [PATCH 08/55] block/file-posix: Reduce xfsctl() use, Michael Roth, 2019/11/05
- [PATCH 04/55] target/alpha: fix tlb_fill trap_arg2 value for instruction fetch, Michael Roth, 2019/11/05
- [PATCH 43/55] qcow2: Limit total allocation range to INT_MAX, Michael Roth, 2019/11/05
- [PATCH 07/55] xen-bus: check whether the frontend is active during device reset..., Michael Roth, 2019/11/05
- [PATCH 53/55] target/xtensa: regenerate and re-import test_mmuhifi_c3 core, Michael Roth, 2019/11/05
- [PATCH 25/55] curl: Check completion in curl_multi_do(), Michael Roth, 2019/11/05
- [PATCH 13/55] iotests: add testing shim for script-style python tests, Michael Roth, 2019/11/05
- [PATCH 49/55] COLO-compare: Fix incorrect `if` logic, Michael Roth, 2019/11/05
- [PATCH 41/55] vhost-user: save features if the char dev is closed, Michael Roth, 2019/11/05
- [PATCH 40/55] iotests: Test internal snapshots with -blockdev, Michael Roth, 2019/11/05
- [PATCH 54/55] scsi: lsi: exit infinite loop while executing script (CVE-2019-12068),
Michael Roth <=
- [PATCH 37/55] roms/Makefile.edk2: don't pull in submodules when building from tarball, Michael Roth, 2019/11/05
- [PATCH 10/55] pr-manager: Fix invalid g_free() crash bug, Michael Roth, 2019/11/05
- Re: [PATCH 00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12, Max Reitz, 2019/11/08
- Re: [PATCH 00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12, Cole Robinson, 2019/11/11
- Re: [PATCH 00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12, Michael Roth, 2019/11/12
- Re: [PATCH 00/55] Patch Round-up for stable 4.1.1, freeze on 2019-11-12, Bruce Rogers, 2019/11/12