[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] scsi: lsi: exit infinite loop while executing s
From: |
Stefano Garzarella |
Subject: |
Re: [Qemu-devel] [PATCH] scsi: lsi: exit infinite loop while executing script (CVE-2019-12068) |
Date: |
Thu, 8 Aug 2019 10:20:07 +0200 |
User-agent: |
NeoMutt/20180716 |
On Thu, Aug 08, 2019 at 12:03:40PM +0530, P J P wrote:
> From: Prasad J Pandit <address@hidden>
>
> When executing script in lsi_execute_script(), the LSI scsi
> adapter emulator advances 's->dsp' index to read next opcode.
> This can lead to an infinite loop if the next opcode is empty.
> Exit such loop after reading 10k empty opcodes.
>
> Reported-by: Bugs SysSec <address@hidden>
> Signed-off-by: Prasad J Pandit <address@hidden>
> ---
> hw/scsi/lsi53c895a.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
> index 10468c1ec1..c23a40525e 100644
> --- a/hw/scsi/lsi53c895a.c
> +++ b/hw/scsi/lsi53c895a.c
> @@ -1132,7 +1132,10 @@ static void lsi_execute_script(LSIState *s)
>
> s->istat1 |= LSI_ISTAT1_SRUN;
> again:
> - insn_processed++;
> + if (++insn_processed > 10000) {
^
Since we are using this "magic" number in several lines,
should we define a macro?
Thanks,
Stefano
> + s->waiting = LSI_NOWAIT;
> + goto exitloop;
> + }
> insn = read_dword(s, s->dsp);
> if (!insn) {
> /* If we receive an empty opcode increment the DSP by 4 bytes
> @@ -1569,6 +1572,7 @@ again:
> }
> }
> }
> +exitloop:
> if (insn_processed > 10000 && s->waiting == LSI_NOWAIT) {
> /* Some windows drivers make the device spin waiting for a memory
> location to change. If we have been executed a lot of code then
> --
> 2.21.0
>
>
--