[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] scsi: lsi: exit infinite loop while executing scrip
From: |
P J P |
Subject: |
[Qemu-devel] [PATCH] scsi: lsi: exit infinite loop while executing script (CVE-2019-12068) |
Date: |
Thu, 8 Aug 2019 12:03:40 +0530 |
From: Prasad J Pandit <address@hidden>
When executing script in lsi_execute_script(), the LSI scsi
adapter emulator advances 's->dsp' index to read next opcode.
This can lead to an infinite loop if the next opcode is empty.
Exit such loop after reading 10k empty opcodes.
Reported-by: Bugs SysSec <address@hidden>
Signed-off-by: Prasad J Pandit <address@hidden>
---
hw/scsi/lsi53c895a.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index 10468c1ec1..c23a40525e 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -1132,7 +1132,10 @@ static void lsi_execute_script(LSIState *s)
s->istat1 |= LSI_ISTAT1_SRUN;
again:
- insn_processed++;
+ if (++insn_processed > 10000) {
+ s->waiting = LSI_NOWAIT;
+ goto exitloop;
+ }
insn = read_dword(s, s->dsp);
if (!insn) {
/* If we receive an empty opcode increment the DSP by 4 bytes
@@ -1569,6 +1572,7 @@ again:
}
}
}
+exitloop:
if (insn_processed > 10000 && s->waiting == LSI_NOWAIT) {
/* Some windows drivers make the device spin waiting for a memory
location to change. If we have been executed a lot of code then
--
2.21.0
- [Qemu-devel] [PATCH] scsi: lsi: exit infinite loop while executing script (CVE-2019-12068),
P J P <=