|
 |
7711c0 |
From 7cf8326f7f34372f1646475f20a2617726aff797 Mon Sep 17 00:00:00 2001
|
|
|
7711c0 |
From: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
7711c0 |
Date: Wed, 7 Nov 2018 18:00:05 +0100
|
|
|
7711c0 |
Subject: [PATCH 31/34] scsi-generic: avoid out-of-bounds access to VPD page
|
|
|
7711c0 |
list
|
|
|
7711c0 |
MIME-Version: 1.0
|
|
|
7711c0 |
Content-Type: text/plain; charset=UTF-8
|
|
|
7711c0 |
Content-Transfer-Encoding: 8bit
|
|
|
7711c0 |
|
|
|
7711c0 |
RH-Author: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
7711c0 |
Message-id: <20181107180007.22954-8-pbonzini@redhat.com>
|
|
|
7711c0 |
Patchwork-id: 82939
|
|
|
7711c0 |
O-Subject: [RHEL7.6.z qemu-kvm-rhev PATCH 7/9] scsi-generic: avoid out-of-bounds access to VPD page list
|
|
|
7711c0 |
Bugzilla: 1566195
|
|
|
7711c0 |
RH-Acked-by: Max Reitz <mreitz@redhat.com>
|
|
|
7711c0 |
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
|
|
|
7711c0 |
RH-Acked-by: Philippe Mathieu-Daudé <philmd@redhat.com>
|
|
|
7711c0 |
|
|
|
7711c0 |
A device can report an excessive number of VPD pages when asked for a
|
|
|
7711c0 |
list; this can cause an out-of-bounds access to buf in
|
|
|
7711c0 |
scsi_generic_set_vpd_bl_emulation. It should not happen, but
|
|
|
7711c0 |
it is technically not incorrect so handle it: do not check any byte
|
|
|
7711c0 |
past the allocation length that was sent to the INQUIRY command.
|
|
|
7711c0 |
|
|
|
7711c0 |
Reported-by: Max Reitz <mreitz@redhat.com>
|
|
|
7711c0 |
Reviewed-by: Max Reitz <mreitz@redhat.com>
|
|
|
7711c0 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
7711c0 |
(cherry picked from commit 57dbb58d800f62b9e56d946660dba4e8dbd20204)
|
|
|
7711c0 |
Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
|
7711c0 |
---
|
|
|
7711c0 |
hw/scsi/scsi-generic.c | 2 +-
|
|
|
7711c0 |
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
7711c0 |
|
|
|
7711c0 |
diff --git a/hw/scsi/scsi-generic.c b/hw/scsi/scsi-generic.c
|
|
|
7711c0 |
index 98c6a34..6d6db69 100644
|
|
|
7711c0 |
--- a/hw/scsi/scsi-generic.c
|
|
|
7711c0 |
+++ b/hw/scsi/scsi-generic.c
|
|
|
7711c0 |
@@ -539,7 +539,7 @@ static void scsi_generic_set_vpd_bl_emulation(SCSIDevice *s)
|
|
|
7711c0 |
}
|
|
|
7711c0 |
|
|
|
7711c0 |
page_len = buf[3];
|
|
|
7711c0 |
- for (i = 4; i < page_len + 4; i++) {
|
|
|
7711c0 |
+ for (i = 4; i < MIN(sizeof(buf), page_len + 4); i++) {
|
|
|
7711c0 |
if (buf[i] == 0xb0) {
|
|
|
7711c0 |
s->needs_vpd_bl_emulation = false;
|
|
|
7711c0 |
return;
|
|
|
7711c0 |
--
|
|
|
7711c0 |
1.8.3.1
|
|
|
7711c0 |
|