Re: [Qemu-devel] [PATCH] i2c: pm_smbus: check smb_index before block transfer write

[Peter Maydell]

On Thu, 6 Dec 2018 at 11:19, Peter Maydell <address@hidden> wrote:
>
> On Thu, 6 Dec 2018 at 11:10, P J P <address@hidden> wrote:
> >
> > +-- On Thu, 6 Dec 2018, Igor Mammedov wrote --+
> > | > From: Prasad J Pandit <address@hidden>
> > | >
> > | > While performing block transfer write in smb_ioport_writeb(),
> > | > 'smb_index' is incremented and used to index smb_data[] array.
> > | > Check 'smb_index' value to avoid OOB access.
> > | >
> > | > Reported-by: Michael Hanselmann <address@hidden>
> > | > Signed-off-by: Prasad J Pandit <address@hidden>
> > | pls squash in:
> > |
> > | Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability
> >
> > Do we need patch v2, or it can be done while merging it?
>
> I can add in the Fixes line when I apply the patch to master.

Oh, I think we should also add to the commit message something
along the lines of:

"Note that this bug is exploitable by a guest to escape
from the virtual machine. However the commit which
introduced the bug was only made after the 3.0 release,
and so it is not present in any released QEMU version."

to clarify that this is a serious bug but also that it's
not one that will be affecting anybody's production systems.

thanks
-- PMM