debian/patches/extra/CVE-2016-7155-scsi-check-page-count-while-initialising-descriptor-.patch

   1 From 7c7e45d2bd1a77fbe89dff83fabf89a46479111f Mon Sep 17 00:00:00 2001
   2 From: Prasad J Pandit <pjp@fedoraproject.org>
   3 Date: Thu, 1 Sep 2016 16:30:51 +0530
   4 Subject: [PATCH 4/6] scsi: check page count while initialising descriptor
   5  rings
   6
   7 Vmware Paravirtual SCSI emulation uses command descriptors to
   8 process SCSI commands. These descriptors come with their ring
   9 buffers. A guest could set the page count for these rings to
  10 an arbitrary value, leading to infinite loop or OOB access.
  11 Add check to avoid it.
  12
  13 Reported-by: Tom Victor <vv474172261@gmail.com>
  14 Reported-by: Li Qiang <liqiang6-s@360.cn>
  15 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  16 ---
  17  hw/scsi/vmw_pvscsi.c | 19 +++++++++----------
  18  1 file changed, 9 insertions(+), 10 deletions(-)
  19
  20 diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
  21 index 2d7528d..22f872c 100644
  22 --- a/hw/scsi/vmw_pvscsi.c
  23 +++ b/hw/scsi/vmw_pvscsi.c
  24 @@ -153,7 +153,7 @@ pvscsi_log2(uint32_t input)
  25      return log;
  26  }
  27
  28 -static int
  29 +static void
  30  pvscsi_ring_init_data(PVSCSIRingInfo *m, PVSCSICmdDescSetupRings *ri)
  31  {
  32      int i;
  33 @@ -161,10 +161,6 @@ pvscsi_ring_init_data(PVSCSIRingInfo *m, PVSCSICmdDescSetupRings *ri)
  34      uint32_t req_ring_size, cmp_ring_size;
  35      m->rs_pa = ri->ringsStatePPN << VMW_PAGE_SHIFT;
  36
  37 -    if ((ri->reqRingNumPages > PVSCSI_SETUP_RINGS_MAX_NUM_PAGES)
  38 -        || (ri->cmpRingNumPages > PVSCSI_SETUP_RINGS_MAX_NUM_PAGES)) {
  39 -        return -1;
  40 -    }
  41      req_ring_size = ri->reqRingNumPages * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
  42      cmp_ring_size = ri->cmpRingNumPages * PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
  43      txr_len_log2 = pvscsi_log2(req_ring_size - 1);
  44 @@ -196,8 +192,6 @@ pvscsi_ring_init_data(PVSCSIRingInfo *m, PVSCSICmdDescSetupRings *ri)
  45
  46      /* Flush ring state page changes */
  47      smp_wmb();
  48 -
  49 -    return 0;
  50  }
  51
  52  static int
  53 @@ -747,7 +741,7 @@ pvscsi_dbg_dump_tx_rings_config(PVSCSICmdDescSetupRings *rc)
  54
  55      trace_pvscsi_tx_rings_num_pages("Confirm Ring", rc->cmpRingNumPages);
  56      for (i = 0; i < rc->cmpRingNumPages; i++) {
  57 -        trace_pvscsi_tx_rings_ppn("Confirm Ring", rc->reqRingPPNs[i]);
  58 +        trace_pvscsi_tx_rings_ppn("Confirm Ring", rc->cmpRingPPNs[i]);
  59      }
  60  }
  61
  62 @@ -780,11 +774,16 @@ pvscsi_on_cmd_setup_rings(PVSCSIState *s)
  63
  64      trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_RINGS");
  65
  66 -    pvscsi_dbg_dump_tx_rings_config(rc);
  67 -    if (pvscsi_ring_init_data(&s->rings, rc) < 0) {
  68 +    if (!rc->reqRingNumPages
  69 +        || rc->reqRingNumPages > PVSCSI_SETUP_RINGS_MAX_NUM_PAGES
  70 +        || !rc->cmpRingNumPages
  71 +        || rc->cmpRingNumPages > PVSCSI_SETUP_RINGS_MAX_NUM_PAGES) {
  72          return PVSCSI_COMMAND_PROCESSING_FAILED;
  73      }
  74
  75 +    pvscsi_dbg_dump_tx_rings_config(rc);
  76 +    pvscsi_ring_init_data(&s->rings, rc);
  77 +
  78      s->rings_info_valid = TRUE;
  79      return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
  80  }
  81 --
  82 2.1.4
  83