xemu/hw/scsi
Prasad J Pandit 7f61f4690d vmw_pvscsi: check page count while initialising descriptor rings
Vmware Paravirtual SCSI emulation uses command descriptors to
process SCSI commands. These descriptors come with their ring
buffers. A guest could set the page count for these rings to
an arbitrary value, leading to infinite loop or OOB access.
Add check to avoid it.

Reported-by: Tom Victor <vv474172261@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <1472626169-12989-1-git-send-email-ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2016-09-13 19:08:46 +02:00
..
esp-pci.c include/qemu/osdep.h: Don't include qapi/error.h 2016-03-22 22:20:15 +01:00
esp.c scsi: esp: fix migration 2016-06-29 14:03:47 +02:00
lsi53c895a.c lsi: never set DMA FIFO Empty (DFE) bit in DSTAT register 2016-09-13 19:08:45 +02:00
Makefile.objs hw: Add support for LSI SAS1068 (mptsas) device 2016-02-09 15:45:26 +01:00
megasas.c megasas: remove useless check for cmd->frame 2016-07-17 09:59:21 +02:00
mfi.h Clean up header guards that don't match their file name 2016-07-12 16:19:16 +02:00
mpi.h hw: Add support for LSI SAS1068 (mptsas) device 2016-02-09 15:45:26 +01:00
mptconfig.c mptsas: add missing va_end 2016-02-16 16:41:17 +01:00
mptendian.c hw: Add support for LSI SAS1068 (mptsas) device 2016-02-09 15:45:26 +01:00
mptsas.c mptsas: really fix migration compatibility 2016-08-03 18:44:56 +02:00
mptsas.h mptsas: really fix migration compatibility 2016-08-03 18:44:56 +02:00
scsi-bus.c scsi-bus: Use longer sense buffer with scanners 2016-07-12 18:31:26 +02:00
scsi-disk.c scsi-disk: change disk serial length from 20 to 36 2016-09-13 19:08:45 +02:00
scsi-generic.c block: Switch transfer length bounds to byte-based 2016-07-05 16:46:25 +02:00
spapr_vscsi.c Fix some typos found by codespell 2016-05-18 15:04:27 +03:00
srp.h spapr-vscsi: add task management 2013-09-12 08:46:21 +02:00
trace-events trace-events: fix first line comment in trace-events 2016-08-12 10:36:01 +01:00
vhost-scsi.c Use #include "..." for our own headers, <...> for others 2016-07-12 16:19:16 +02:00
viosrp.h hw: move private headers to hw/ subdirectories. 2013-04-08 18:13:16 +02:00
virtio-scsi-dataplane.c Use #include "..." for our own headers, <...> for others 2016-07-12 16:19:16 +02:00
virtio-scsi.c virtio-scsi: Wrap in vmstate 2016-07-21 20:44:20 +03:00
vmw_pvscsi.c vmw_pvscsi: check page count while initialising descriptor rings 2016-09-13 19:08:46 +02:00
vmw_pvscsi.h scsi: VMWare PVSCSI paravirtual device implementation 2013-04-19 10:44:17 +02:00