debian/patches/extra/0011-vmw_pvscsi-check-message-ring-page-count-at-initiali.patch

   1 From d2eb933639fa12bfa36238c72b1c5a8fb59bdfcd Mon Sep 17 00:00:00 2001
   2 From: P J P <ppandit@redhat.com>
   3 Date: Tue, 25 Apr 2017 18:36:23 +0530
   4 Subject: [PATCH 11/15] vmw_pvscsi: check message ring page count at
   5  initialisation
   6
   7 A guest could set the message ring page count to zero, resulting in
   8 infinite loop. Add check to avoid it.
   9
  10 Reported-by: YY Z <bigbird475958471@gmail.com>
  11 Signed-off-by: P J P <ppandit@redhat.com>
  12 Message-Id: <20170425130623.3649-1-ppandit@redhat.com>
  13 Reviewed-by: Dmitry Fleytman <dmitry@daynix.com>
  14 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  15 ---
  16  hw/scsi/vmw_pvscsi.c | 2 +-
  17  1 file changed, 1 insertion(+), 1 deletion(-)
  18
  19 diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
  20 index 75575461e2..4a106da856 100644
  21 --- a/hw/scsi/vmw_pvscsi.c
  22 +++ b/hw/scsi/vmw_pvscsi.c
  23 @@ -202,7 +202,7 @@ pvscsi_ring_init_msg(PVSCSIRingInfo *m, PVSCSICmdDescSetupMsgRing *ri)
  24      uint32_t len_log2;
  25      uint32_t ring_size;
  26
  27 -    if (ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {
  28 +    if (!ri->numPages || ri->numPages > PVSCSI_SETUP_MSG_RING_MAX_NUM_PAGES) {
  29          return -1;
  30      }
  31      ring_size = ri->numPages * PVSCSI_MAX_NUM_MSG_ENTRIES_PER_PAGE;
  32 --
  33 2.11.0
  34