vmw_pvscsi: check page count while initialising descriptor rings
authorPrasad J Pandit <pjp@fedoraproject.org>
Wed, 31 Aug 2016 06:49:29 +0000 (12:19 +0530)
committerMichael Roth <mdroth@linux.vnet.ibm.com>
Tue, 20 Sep 2016 16:03:33 +0000 (11:03 -0500)
commitda99530e410349d672e792e820b355a648d430fa
tree59fbd8ebe647a3218b10a4ff7b2d93681cf7e2fb
parent7aa7c25186fc0cf9d9dd3edf88c8f15deeec3c00
vmw_pvscsi: check page count while initialising descriptor rings

Vmware Paravirtual SCSI emulation uses command descriptors to
process SCSI commands. These descriptors come with their ring
buffers. A guest could set the page count for these rings to
an arbitrary value, leading to infinite loop or OOB access.
Add check to avoid it.

Reported-by: Tom Victor <vv474172261@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <1472626169-12989-1-git-send-email-ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 7f61f4690dd153be98900a2a508b88989e692753)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>
hw/scsi/vmw_pvscsi.c