* [Qemu-devel] [PATCH v2] scsi: megasas: check 'read_queue_head' index value
@ 2016-05-25 12:25 P J P
2016-05-25 12:30 ` Alexander Graf
0 siblings, 1 reply; 2+ messages in thread
From: P J P @ 2016-05-25 12:25 UTC (permalink / raw)
To: Qemu Developers
Cc: Paolo Bonzini, Li Qiang, Hannes Reinecke, Alexander Graf,
Prasad J Pandit
From: Prasad J Pandit <pjp@fedoraproject.org>
While doing MegaRAID SAS controller command frame lookup, routine
'megasas_lookup_frame' uses 'read_queue_head' value as an index
into 'frames[MEGASAS_MAX_FRAMES=2048]' array. Limit its value
within array bounds to avoid any OOB access.
Reported-by: Li Qiang <liqiang6-s@360.cn>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
---
hw/scsi/megasas.c | 2 ++
1 file changed, 2 insertions(+)
Update as per
-> https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04403.html
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index bf642d4..cc66d36 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -650,7 +650,9 @@ static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
pa_hi = le32_to_cpu(initq->pi_addr_hi);
s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
s->reply_queue_head = ldl_le_pci_dma(pcid, s->producer_pa);
+ s->reply_queue_head %= MEGASAS_MAX_FRAMES;
s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
+ s->reply_queue_tail %= MEGASAS_MAX_FRAMES;
flags = le32_to_cpu(initq->flags);
if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
s->flags |= MEGASAS_MASK_USE_QUEUE64;
--
2.5.5
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [Qemu-devel] [PATCH v2] scsi: megasas: check 'read_queue_head' index value
2016-05-25 12:25 [Qemu-devel] [PATCH v2] scsi: megasas: check 'read_queue_head' index value P J P
@ 2016-05-25 12:30 ` Alexander Graf
0 siblings, 0 replies; 2+ messages in thread
From: Alexander Graf @ 2016-05-25 12:30 UTC (permalink / raw)
To: P J P, Qemu Developers
Cc: Paolo Bonzini, Li Qiang, Hannes Reinecke, Prasad J Pandit
On 05/25/2016 02:25 PM, P J P wrote:
> From: Prasad J Pandit <pjp@fedoraproject.org>
>
> While doing MegaRAID SAS controller command frame lookup, routine
> 'megasas_lookup_frame' uses 'read_queue_head' value as an index
> into 'frames[MEGASAS_MAX_FRAMES=2048]' array. Limit its value
> within array bounds to avoid any OOB access.
>
> Reported-by: Li Qiang <liqiang6-s@360.cn>
> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Reviewed-by: Alexander Graf <agraf@suse.de>
Alex
> ---
> hw/scsi/megasas.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> Update as per
> -> https://lists.gnu.org/archive/html/qemu-devel/2016-05/msg04403.html
>
> diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
> index bf642d4..cc66d36 100644
> --- a/hw/scsi/megasas.c
> +++ b/hw/scsi/megasas.c
> @@ -650,7 +650,9 @@ static int megasas_init_firmware(MegasasState *s, MegasasCmd *cmd)
> pa_hi = le32_to_cpu(initq->pi_addr_hi);
> s->producer_pa = ((uint64_t) pa_hi << 32) | pa_lo;
> s->reply_queue_head = ldl_le_pci_dma(pcid, s->producer_pa);
> + s->reply_queue_head %= MEGASAS_MAX_FRAMES;
> s->reply_queue_tail = ldl_le_pci_dma(pcid, s->consumer_pa);
> + s->reply_queue_tail %= MEGASAS_MAX_FRAMES;
> flags = le32_to_cpu(initq->flags);
> if (flags & MFI_QUEUE_FLAG_CONTEXT64) {
> s->flags |= MEGASAS_MASK_USE_QUEUE64;
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2016-05-25 12:30 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-05-25 12:25 [Qemu-devel] [PATCH v2] scsi: megasas: check 'read_queue_head' index value P J P
2016-05-25 12:30 ` Alexander Graf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).