Re: [Qemu-devel] [PATCH] scsi: pvscsi: limit process IO loop to maximum page count

[P J P <ppandit@redhat.com>]

+-- On Wed, 7 Sep 2016, P J P wrote --+
| From: Prasad J Pandit <pjp@fedoraproject.org>
| 
| Vmware Paravirtual SCSI emulator while processing IO requests
| could run into an infinite loop if 'pvscsi_ring_pop_req_descr'
| always returned positive value. Limit IO loop to the maximum
| page count.
| 
| Reported-by: Li Qiang <liqiang6-s@360.cn>
| Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
| ---
|  hw/scsi/vmw_pvscsi.c | 4 +++-
|  1 file changed, 3 insertions(+), 1 deletion(-)
| 
| diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
| index babac5a..3e77a08 100644
| --- a/hw/scsi/vmw_pvscsi.c
| +++ b/hw/scsi/vmw_pvscsi.c
| @@ -711,11 +711,13 @@ pvscsi_process_request_descriptor(PVSCSIState *s,
|  static void
|  pvscsi_process_io(PVSCSIState *s)
|  {
| +    int descr_pa_cnt = 0;
|      PVSCSIRingReqDesc descr;
|      hwaddr next_descr_pa;
|  
|      assert(s->rings_info_valid);
| -    while ((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0) {
| +    while (((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0)
| +            && descr_pa_cnt++ < PVSCSI_SETUP_RINGS_MAX_NUM_PAGES) {
|  
|          /* Only read after production index verification */
|          smp_rmb();

Ping...!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F