[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 33/58] scsi: pvscsi: limit loop to fetch SG list
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 33/58] scsi: pvscsi: limit loop to fetch SG list |
Date: |
Tue, 13 Sep 2016 19:16:04 +0200 |
From: Prasad J Pandit <address@hidden>
In PVSCSI paravirtual SCSI bus, pvscsi_convert_sglist can take a very
long time or go into an infinite loop due to two different bugs:
1) the request descriptor data length is defined to be 64 bit. While
building SG list from a request descriptor, it gets truncated to 32bit
in routine 'pvscsi_convert_sglist'. This could lead to an infinite loop
situation large 'dataLen' values when data_length is cast to uint32_t and
chunk_size becomes always zero. Fix this by removing the incorrect cast.
2) pvscsi_get_next_sg_elem can be called arbitrarily many times if the
element has a zero length. Get out of the loop early when this happens,
by introducing an upper limit on the number of SG list elements.
Reported-by: Li Qiang <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
---
hw/scsi/vmw_pvscsi.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
index 4245c15..babac5a 100644
--- a/hw/scsi/vmw_pvscsi.c
+++ b/hw/scsi/vmw_pvscsi.c
@@ -40,6 +40,8 @@
#define PVSCSI_MAX_DEVS (64)
#define PVSCSI_MSIX_NUM_VECTORS (1)
+#define PVSCSI_MAX_SG_ELEM 2048
+
#define PVSCSI_MAX_CMD_DATA_WORDS \
(sizeof(PVSCSICmdDescSetupRings)/sizeof(uint32_t))
@@ -628,17 +630,16 @@ pvscsi_queue_pending_descriptor(PVSCSIState *s,
SCSIDevice **d,
static void
pvscsi_convert_sglist(PVSCSIRequest *r)
{
- int chunk_size;
+ uint32_t chunk_size, elmcnt = 0;
uint64_t data_length = r->req.dataLen;
PVSCSISGState sg = r->sg;
- while (data_length) {
- while (!sg.resid) {
+ while (data_length && elmcnt < PVSCSI_MAX_SG_ELEM) {
+ while (!sg.resid && elmcnt++ < PVSCSI_MAX_SG_ELEM) {
pvscsi_get_next_sg_elem(&sg);
trace_pvscsi_convert_sglist(r->req.context, r->sg.dataAddr,
r->sg.resid);
}
- assert(data_length > 0);
- chunk_size = MIN((unsigned) data_length, sg.resid);
+ chunk_size = MIN(data_length, sg.resid);
if (chunk_size) {
qemu_sglist_add(&r->sgl, sg.dataAddr, chunk_size);
}
--
1.8.3.1
- [Qemu-devel] [PULL 22/58] MAINTAINERS: add myself as stubs maintainers, (continued)
- [Qemu-devel] [PULL 22/58] MAINTAINERS: add myself as stubs maintainers, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 25/58] scsi: mptconfig: fix an assert expression, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 26/58] scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACK, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 27/58] vmxcap: Show raw MSR value, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 28/58] vmxcap: Add TSC scaling bit, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 30/58] chardev: Add 'help' option to print all available chardev backend types, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 29/58] doc/rcu: fix typo, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 31/58] MAINTAINERS: Fix wildcard for scsi headers, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 32/58] MAINTAINERS: Add some header files to the PC chipset section, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 35/58] default-configs: removed obsolete CONFIG_ISA_MMIO, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 33/58] scsi: pvscsi: limit loop to fetch SG list,
Paolo Bonzini <=
- [Qemu-devel] [PULL 34/58] default-configs: remove CONFIG_PAM, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 38/58] sclpconsolelm: remove bogus check for -EAGAIN, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 37/58] ipmi: check return of qemu_chr_fe_write() for errors, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 40/58] char: convert qemu_chr_fe_write to qemu_chr_fe_write_all, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 39/58] hw: replace most use of qemu_chr_fe_write with qemu_chr_fe_write_all, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 42/58] i8257: Make device "i8257" unavailable with -device, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 43/58] kvm-all: drop kvm_setup_guest_memory, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 41/58] Revert "megasas: remove useless check for cmd->frame", Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 36/58] default-configs: remove CONFIG_PIIX_PCI, Paolo Bonzini, 2016/09/13
- [Qemu-devel] [PULL 45/58] atomics: Use __atomic_*_n() variant primitives, Paolo Bonzini, 2016/09/13