debian/patches/extra/CVE-2016-7421-scsi-pvscsi-limit-process-IO-loop-to-ring-size.patch

   1 From d251157ac1928191af851d199a9ff255d330bec9 Mon Sep 17 00:00:00 2001
   2 From: Prasad J Pandit <pjp@fedoraproject.org>
   3 Date: Wed, 14 Sep 2016 15:09:12 +0530
   4 Subject: [PATCH] scsi: pvscsi: limit process IO loop to ring size
   5
   6 Vmware Paravirtual SCSI emulator while processing IO requests
   7 could run into an infinite loop if 'pvscsi_ring_pop_req_descr'
   8 always returned positive value. Limit IO loop to the ring size.
   9
  10 Cc: qemu-stable@nongnu.org
  11 Reported-by: Li Qiang <liqiang6-s@360.cn>
  12 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  13 Message-Id: <1473845952-30785-1-git-send-email-ppandit@redhat.com>
  14 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  15 ---
  16  hw/scsi/vmw_pvscsi.c | 5 ++++-
  17  1 file changed, 4 insertions(+), 1 deletion(-)
  18
  19 diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
  20 index babac5a..a5ce7de 100644
  21 --- a/hw/scsi/vmw_pvscsi.c
  22 +++ b/hw/scsi/vmw_pvscsi.c
  23 @@ -247,8 +247,11 @@ static hwaddr
  24  pvscsi_ring_pop_req_descr(PVSCSIRingInfo *mgr)
  25  {
  26      uint32_t ready_ptr = RS_GET_FIELD(mgr, reqProdIdx);
  27 +    uint32_t ring_size = PVSCSI_MAX_NUM_PAGES_REQ_RING
  28 +                            * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
  29
  30 -    if (ready_ptr != mgr->consumed_ptr) {
  31 +    if (ready_ptr != mgr->consumed_ptr
  32 +        && ready_ptr - mgr->consumed_ptr < ring_size) {
  33          uint32_t next_ready_ptr =
  34              mgr->consumed_ptr++ & mgr->txr_len_mask;
  35          uint32_t next_ready_page =
  36 --
  37 2.1.4
  38