Re: [Qemu-devel] [PATCH v3 1/2] scsi: lsi: exit infinite loop while executing script (CVE-2019-12068)

[P J P]

+-- On Fri, 9 Aug 2019, P J P wrote --+
| From: Prasad J Pandit <address@hidden>
| 
| When executing script in lsi_execute_script(), the LSI scsi
| adapter emulator advances 's->dsp' index to read next opcode.
| This can lead to an infinite loop if the next opcode is empty.
| Exit such loop after reading 10k empty opcodes.
| 
| Reported-by: Bugs SysSec <address@hidden>
| Signed-off-by: Prasad J Pandit <address@hidden>
| ---
|  hw/scsi/lsi53c895a.c | 11 ++++++++++-
|  1 file changed, 10 insertions(+), 1 deletion(-)
| 
| Update v3: raise an illegal instruction interrupt and exit
|   -> https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01427.html
| 
| diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
| index 10468c1ec1..e703ef4c9d 100644
| --- a/hw/scsi/lsi53c895a.c
| +++ b/hw/scsi/lsi53c895a.c
| @@ -185,6 +185,9 @@ static const char *names[] = {
|  /* Flag set if this is a tagged command.  */
|  #define LSI_TAG_VALID     (1 << 16)
|  
| +/* Maximum instructions to process. */
| +#define LSI_MAX_INSN    10000
| +
|  typedef struct lsi_request {
|      SCSIRequest *req;
|      uint32_t tag;
| @@ -1132,7 +1135,13 @@ static void lsi_execute_script(LSIState *s)
|  
|      s->istat1 |= LSI_ISTAT1_SRUN;
|  again:
| -    insn_processed++;
| +    if (++insn_processed > LSI_MAX_INSN) {
| +        trace_lsi_execute_script_tc_illegal();
| +        lsi_script_dma_interrupt(s, LSI_DSTAT_IID);
| +        lsi_disconnect(s);
| +        trace_lsi_execute_script_stop();
| +        return;
| +    }
|      insn = read_dword(s, s->dsp);
|      if (!insn) {
|          /* If we receive an empty opcode increment the DSP by 4 bytes
| 

Ping...?!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F