Prasad J Pandit bd6dd4eaa6 lsi53c895a: check message length value is valid ...

While writing a message in 'lsi_do_msgin', message length value
in 'msg_len' could be invalid due to an invalid migration stream.
Add an assertion to avoid an out of bounds access, and reject
the incoming migration data if it contains an invalid message
length.

Discovered by Deja vu Security. Reported by Oracle.

Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-Id: <20181026194314.18663-1-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit e58ccf0396)
*CVE-2018-18849
*avoid context dep. on c921370b22
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

2019-04-02 13:15:18 -05:00

..

esp-pci.c

pci: Add INTERFACE_CONVENTIONAL_PCI_DEVICE to Conventional PCI devices

2017-10-15 05:54:43 +03:00

esp.c

esp: remove legacy esp_init() function

2018-06-28 19:05:36 +02:00

lsi53c895a.c

lsi53c895a: check message length value is valid

2019-04-02 13:15:18 -05:00

Makefile.objs

hw: make virtio devices configurable via default-configs/

2018-06-01 15:14:31 +02:00

megasas.c

pci: removed the is_express field since a uniform interface was inserted

2018-02-08 21:06:41 +02:00

mfi.h

Clean up header guards that don't match their file name

2016-07-12 16:19:16 +02:00

mpi.h

hw: Add support for LSI SAS1068 (mptsas) device

2016-02-09 15:45:26 +01:00

mptconfig.c

scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACK

2016-09-13 19:08:46 +02:00

mptendian.c

hw: Do not include "sysemu/block-backend.h" if it is not necessary

2018-03-12 16:12:46 +01:00

mptsas.c

hw: Do not include "sysemu/block-backend.h" if it is not necessary

2018-06-01 14:15:10 +02:00

mptsas.h

mptsas: really fix migration compatibility

2016-08-03 18:44:56 +02:00

scsi-bus.c

usb-storage: Add rerror/werror properties

2018-06-29 14:20:56 +02:00

scsi-disk.c

scsi-disk: Block Device Characteristics emulation fix

2018-07-12 18:24:08 +02:00

scsi-generic.c

hw/scsi: add VPD Block Limits emulation

2018-06-29 13:02:50 +02:00

spapr_vscsi.c

scsi: Remove automatic creation of SCSI controllers with -drive if=scsi

2018-03-06 14:00:59 +01:00

srp.h

spapr-vscsi: add task management

2013-09-12 08:46:21 +02:00

trace-events

trace-events: fix code style: print 0x before hex numbers

2017-08-01 12:13:07 +01:00

vhost-scsi-common.c

vhost-scsi: drop an unused include

2018-06-01 19:20:37 +03:00

vhost-scsi.c

vhost-scsi: prevent using uninitialized vqs

2019-03-27 01:31:28 -05:00

vhost-user-scsi.c

vhost-user: introduce shared vhost-user state

2018-05-24 21:14:11 +03:00

viosrp.h

hw: move private headers to hw/ subdirectories.

2013-04-08 18:13:16 +02:00

virtio-scsi-dataplane.c

Replace '-enable-kvm' with '-accel kvm' in docs and help texts

2018-06-28 19:05:32 +02:00

virtio-scsi.c

virtio-scsi: fix hotplug ->reset() vs event race

2018-07-16 16:58:16 +02:00

vmw_pvscsi.c

qdev: use device_class_set_parent_realize/unrealize/reset()

2018-02-05 13:54:38 +01:00

vmw_pvscsi.h

scsi: VMWare PVSCSI paravirtual device implementation

2013-04-19 10:44:17 +02:00