debian/patches/extra/CVE-2016-4952-scsi-pvscsi-check-command-descriptor-ring-buffer-siz.patch

   1 From 6b7e3826cdc316808bd6e866320237049665c417 Mon Sep 17 00:00:00 2001
   2 From: Prasad J Pandit <pjp@fedoraproject.org>
   3 Date: Mon, 23 May 2016 16:18:05 +0530
   4 Subject: [PATCH] scsi: pvscsi: check command descriptor ring buffer size
   5
   6 Vmware Paravirtual SCSI emulation uses command descriptors to
   7 process SCSI commands. These descriptors come with their ring
   8 buffers. A guest could set the ring buffer size to an arbitrary
   9 value leading to OOB access issue. Add check to avoid it.
  10
  11 Reported-by: Li Qiang <liqiang6-s@360.cn>
  12 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
  13 ---
  14  hw/scsi/vmw_pvscsi.c | 24 ++++++++++++++++++++----
  15  1 file changed, 20 insertions(+), 4 deletions(-)
  16
  17 diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
  18 index 9c71f31..a6c5cc4 100644
  19 --- a/hw/scsi/vmw_pvscsi.c
  20 +++ b/hw/scsi/vmw_pvscsi.c
  21 @@ -126,7 +126,7 @@ pvscsi_log2(uint32_t input)
  22      return log;
  23  }
  24
  25 -static void
  26 +static int
  27  pvscsi_ring_init_data(PVSCSIRingInfo *m, PVSCSICmdDescSetupRings *ri)
  28  {
  29      int i;
  30 @@ -134,6 +134,10 @@ pvscsi_ring_init_data(PVSCSIRingInfo *m, PVSCSICmdDescSetupRings *ri)
  31      uint32_t req_ring_size, cmp_ring_size;
  32      m->rs_pa = ri->ringsStatePPN << VMW_PAGE_SHIFT;
  33
  34 +    if ((ri->reqRingNumPages > PVSCSI_SETUP_RINGS_MAX_NUM_PAGES)
  35 +        || (ri->cmpRingNumPages > PVSCSI_SETUP_RINGS_MAX_NUM_PAGES)) {
  36 +        return -1;
  37 +    }
  38      req_ring_size = ri->reqRingNumPages * PVSCSI_MAX_NUM_REQ_ENTRIES_PER_PAGE;
  39      cmp_ring_size = ri->cmpRingNumPages * PVSCSI_MAX_NUM_CMP_ENTRIES_PER_PAGE;
  40      txr_len_log2 = pvscsi_log2(req_ring_size - 1);
  41 @@ -165,15 +169,20 @@ pvscsi_ring_init_data(PVSCSIRingInfo *m, PVSCSICmdDescSetupRings *ri)
  42
  43      /* Flush ring state page changes */
  44      smp_wmb();
  45 +
  46 +    return 0;
  47  }
  48
  49 -static void
  50 +static int
  51  pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri)
  52  {
  53      int i;
  54      uint32_t len_log2;
  55      uint32_t ring_size;
  56
  57 +    if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {
  58 +        return -1;
  59 +    }
  60      ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
  61      len_log2 = pvscsi_log2(ring_size - 1);
  62
  63 @@ -193,6 +202,8 @@ pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri)
  64
  65      /* Flush ring state page changes */
  66      smp_wmb();
  67 +
  68 +    return 0;
  69  }
  70
  71  static void
  72 @@ -743,7 +754,10 @@ pvscsi_on_cmd_setup_rings(PVSCSIState *s)
  73      trace_pvscsi_on_cmd_arrived("PVSCSI_CMD_SETUP_RINGS");
  74
  75      pvscsi_dbg_dump_tx_rings_config(rc);
  76 -    pvscsi_ring_init_data(&s->rings, rc);
  77 +    if (pvscsi_ring_init_data(&s->rings, rc) < 0) {
  78 +        return PVSCSI_COMMAND_PROCESSING_FAILED;
  79 +    }
  80 +
  81      s->rings_info_valid = TRUE;
  82      return PVSCSI_COMMAND_PROCESSING_SUCCEEDED;
  83  }
  84 @@ -823,7 +837,9 @@ pvscsi_on_cmd_setup_msg_ring(PVSCSIState *s)
  85      }
  86
  87      if (s->rings_info_valid) {
  88 -        pvscsi_ring_init_msg(&s->rings, rc);
  89 +        if (pvscsi_ring_init_msg(&s->rings, rc) < 0) {
  90 +            return PVSCSI_COMMAND_PROCESSING_FAILED;
  91 +        }
  92          s->msg_ring_info_valid = TRUE;
  93      }
  94      return sizeof(PVSCSICmdDescSetupMsgRing) / sizeof(uint32_t);
  95 --
  96 2.1.4
  97