Prasad J Pandit 7f61f4690d vmw_pvscsi: check page count while initialising descriptor rings ...

Vmware Paravirtual SCSI emulation uses command descriptors to
process SCSI commands. These descriptors come with their ring
buffers. A guest could set the page count for these rings to
an arbitrary value, leading to infinite loop or OOB access.
Add check to avoid it.

Reported-by: Tom Victor <vv474172261@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <1472626169-12989-1-git-send-email-ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

2016-09-13 19:08:46 +02:00

..

esp-pci.c

include/qemu/osdep.h: Don't include qapi/error.h

2016-03-22 22:20:15 +01:00

esp.c

scsi: esp: fix migration

2016-06-29 14:03:47 +02:00

lsi53c895a.c

lsi: never set DMA FIFO Empty (DFE) bit in DSTAT register

2016-09-13 19:08:45 +02:00

Makefile.objs

hw: Add support for LSI SAS1068 (mptsas) device

2016-02-09 15:45:26 +01:00

megasas.c

megasas: remove useless check for cmd->frame

2016-07-17 09:59:21 +02:00

mfi.h

Clean up header guards that don't match their file name

2016-07-12 16:19:16 +02:00

mpi.h

hw: Add support for LSI SAS1068 (mptsas) device

2016-02-09 15:45:26 +01:00

mptconfig.c

mptsas: add missing va_end

2016-02-16 16:41:17 +01:00

mptendian.c

hw: Add support for LSI SAS1068 (mptsas) device

2016-02-09 15:45:26 +01:00

mptsas.c

mptsas: really fix migration compatibility

2016-08-03 18:44:56 +02:00

mptsas.h

mptsas: really fix migration compatibility

2016-08-03 18:44:56 +02:00

scsi-bus.c

scsi-bus: Use longer sense buffer with scanners

2016-07-12 18:31:26 +02:00

scsi-disk.c

scsi-disk: change disk serial length from 20 to 36

2016-09-13 19:08:45 +02:00

scsi-generic.c

block: Switch transfer length bounds to byte-based

2016-07-05 16:46:25 +02:00

spapr_vscsi.c

Fix some typos found by codespell

2016-05-18 15:04:27 +03:00

srp.h

…

trace-events

trace-events: fix first line comment in trace-events

2016-08-12 10:36:01 +01:00

vhost-scsi.c

Use #include "..." for our own headers, <...> for others

2016-07-12 16:19:16 +02:00

viosrp.h

…

virtio-scsi-dataplane.c

Use #include "..." for our own headers, <...> for others

2016-07-12 16:19:16 +02:00

virtio-scsi.c

virtio-scsi: Wrap in vmstate

2016-07-21 20:44:20 +03:00

vmw_pvscsi.c

vmw_pvscsi: check page count while initialising descriptor rings

2016-09-13 19:08:46 +02:00

vmw_pvscsi.h

…