From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:41404) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Re6HH-0007HL-AP for qemu-devel@nongnu.org; Fri, 23 Dec 2011 09:39:24 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Re6HB-0002ek-QB for qemu-devel@nongnu.org; Fri, 23 Dec 2011 09:39:19 -0500 Received: from mail-iy0-f173.google.com ([209.85.210.173]:43814) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Re6HB-0002ef-NC for qemu-devel@nongnu.org; Fri, 23 Dec 2011 09:39:13 -0500 Received: by iagj37 with SMTP id j37so17327724iag.4 for ; Fri, 23 Dec 2011 06:39:13 -0800 (PST) Sender: Paolo Bonzini From: Paolo Bonzini Date: Fri, 23 Dec 2011 15:39:03 +0100 Message-Id: <1324651143-5247-1-git-send-email-pbonzini@redhat.com> Subject: [Qemu-devel] [PATCH] virtio-blk: refuse SG_IO requests with scsi=off List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org QEMU does have a "scsi" option (to be used like -device virtio-blk-pci,drive=foo,scsi=off). However, it only masks the feature bit, and does not reject the command if a malicious guest disregards the feature bits and issues a request. Without this patch, using scsi=off does not protect you from CVE-2011-4127. Signed-off-by: Paolo Bonzini --- hw/virtio-blk.c | 6 ++++++ 1 files changed, 6 insertions(+), 0 deletions(-) diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c index b70d116..6cd3164 100644 --- a/hw/virtio-blk.c +++ b/hw/virtio-blk.c @@ -153,6 +153,12 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req) int status; int i; + if ((req->dev->vdev.guest_features & (1 << VIRTIO_BLK_F_SCSI)) == 0) { + virtio_blk_req_complete(req, VIRTIO_BLK_S_UNSUPP); + g_free(req); + return; + } + /* * We require at least one output segment each for the virtio_blk_outhdr * and the SCSI command block. -- 1.7.7.1