[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-stable] [PATCH 19/56] block/iscsi: avoid potential overflow of acb
From: |
Michael Roth |
Subject: |
[Qemu-stable] [PATCH 19/56] block/iscsi: avoid potential overflow of acb->task->cdb |
Date: |
Mon, 8 Aug 2016 16:03:50 -0500 |
From: Peter Lieven <address@hidden>
at least in the path via virtio-blk the maximum size is not
restricted.
Cc: address@hidden
Signed-off-by: Peter Lieven <address@hidden>
Message-Id: <address@hidden>
Signed-off-by: Paolo Bonzini <address@hidden>
(cherry picked from commit a6b3167fa0e825aebb5a7cd8b437b6d41584a196)
Signed-off-by: Michael Roth <address@hidden>
---
block/iscsi.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/block/iscsi.c b/block/iscsi.c
index 302baf8..172e6cf 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -837,6 +837,13 @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
return &acb->common;
}
+ if (acb->ioh->cmd_len > SCSI_CDB_MAX_SIZE) {
+ error_report("iSCSI: ioctl error CDB exceeds max size (%d > %d)",
+ acb->ioh->cmd_len, SCSI_CDB_MAX_SIZE);
+ qemu_aio_unref(acb);
+ return NULL;
+ }
+
acb->task = malloc(sizeof(struct scsi_task));
if (acb->task == NULL) {
error_report("iSCSI: Failed to allocate task for scsi command. %s",
--
1.9.1
- [Qemu-stable] [PATCH 09/56] configure: Allow builds with extra warnings, (continued)
- [Qemu-stable] [PATCH 09/56] configure: Allow builds with extra warnings, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 10/56] migration: regain control of images when migration fails to complete, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 11/56] json-streamer: Don't leak tokens on incomplete parse, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 12/56] json-streamer: fix double-free on exiting during a parse, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 13/56] esp: check command buffer length before write(CVE-2016-4439), Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 16/56] usb/ohci: Fix crash with when specifying too many num-ports, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 15/56] block/nfs: refuse readahead if cache.direct is on, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 17/56] vga: add sr_vbe register set, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 14/56] esp: check dma length before reading scsi command(CVE-2016-4441), Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 22/56] Fix configure test for PBKDF2 in nettle, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 19/56] block/iscsi: avoid potential overflow of acb->task->cdb,
Michael Roth <=
- [Qemu-stable] [PATCH 01/56] i386: kvmvapic: initialise imm32 variable, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 18/56] vfio: Fix broken EEH, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 20/56] nbd: Don't trim unrequested bytes, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 24/56] scsi: mptsas: infinite loop while fetching requests, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 21/56] savevm: fail if migration blockers are present, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 23/56] scsi: pvscsi: check command descriptor ring buffer size (CVE-2016-4952), Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 26/56] vmsvga: move fifo sanity checks to vmsvga_fifo_length, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 30/56] io: remove mistaken call to object_ref on QTask, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 33/56] backup: Don't leak BackupBlockJob in error path, Michael Roth, 2016/08/08
- [Qemu-stable] [PATCH 31/56] ui: fix regression in printing VNC host/port on startup, Michael Roth, 2016/08/08