Paolo Bonzini 051c9b3cbc scsi: lsi: exit infinite loop while executing script (CVE-2019-12068) ...

When executing script in lsi_execute_script(), the LSI scsi adapter
emulator advances 's->dsp' index to read next opcode. This can lead
to an infinite loop if the next opcode is empty. Move the existing
loop exit after 10k iterations so that it covers no-op opcodes as
well.

Reported-by: Bugs SysSec <bugs-syssec@rub.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit de594e4765)
Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com>

2019-11-05 13:39:31 -06:00

..

emulation.c

scsi-generic: avoid invalid access to struct when emulating block limits

2018-11-06 21:35:06 +01:00

esp-pci.c

Include qemu/module.h where needed, drop it from qemu-common.h

2019-06-12 13:18:33 +02:00

esp.c

Include qemu/module.h where needed, drop it from qemu-common.h

2019-06-12 13:18:33 +02:00

Kconfig

virtio: express virtio dependencies with Kconfig

2019-03-07 21:45:53 +01:00

lsi53c895a.c

scsi: lsi: exit infinite loop while executing script (CVE-2019-12068)

2019-11-05 13:39:31 -06:00

Makefile.objs

scsi: express dependencies with Kconfig

2019-03-07 21:45:53 +01:00

megasas.c

Include qemu-common.h exactly where needed

2019-06-12 13:20:20 +02:00

mfi.h

Clean up header guards that don't match their file name

2016-07-12 16:19:16 +02:00

mpi.h

hw: Add support for LSI SAS1068 (mptsas) device

2016-02-09 15:45:26 +01:00

mptconfig.c

scsi: mptconfig: fix misuse of MPTSAS_CONFIG_PACK

2016-09-13 19:08:46 +02:00

mptendian.c

hw/scsi/mptendian: Avoid taking address of fields in packed structs

2018-10-02 19:09:14 +02:00

mptsas.c

Include qemu/module.h where needed, drop it from qemu-common.h

2019-06-12 13:18:33 +02:00

mptsas.h

mptsas: really fix migration compatibility

2016-08-03 18:44:56 +02:00

scsi-bus.c

virtio-scsi: restart DMA after iothread

2019-07-08 16:00:26 +02:00

scsi-disk.c

scsi-cd: Fix inserting read-only media in empty drive

2019-07-30 13:21:38 +02:00

scsi-generic.c

scsi-generic: Check sense key before request snooping and patching

2019-07-19 19:04:49 +02:00

spapr_vscsi.c

Include qemu/module.h where needed, drop it from qemu-common.h

2019-06-12 13:18:33 +02:00

srp.h

spapr-vscsi: add task management

2013-09-12 08:46:21 +02:00

trace-events

trace-events: Shorten file names in comments

2019-03-22 16:18:07 +00:00

vhost-scsi-common.c

Include qemu/module.h where needed, drop it from qemu-common.h

2019-06-12 13:18:33 +02:00

vhost-scsi.c

vhost-scsi: Call virtio_scsi_common_unrealize() when device realize failed

2019-07-19 19:04:49 +02:00

vhost-user-scsi.c

vhost-user-scsi: Call virtio_scsi_common_unrealize() when device realize failed

2019-07-19 19:04:49 +02:00

viosrp.h

…

virtio-scsi-dataplane.c

Replace '-enable-kvm' with '-accel kvm' in docs and help texts

2018-06-28 19:05:32 +02:00

virtio-scsi.c

virtio-scsi: fixed virtio_scsi_ctx_check failed when detaching scsi disk

2019-07-24 11:21:53 +02:00

vmw_pvscsi.c

Include qemu/module.h where needed, drop it from qemu-common.h

2019-06-12 13:18:33 +02:00

vmw_pvscsi.h

…