From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:41775) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Rljb4-0006JF-Oy for qemu-devel@nongnu.org; Fri, 13 Jan 2012 11:03:22 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Rljb0-0002tR-K8 for qemu-devel@nongnu.org; Fri, 13 Jan 2012 11:03:18 -0500 Received: from lo.gmane.org ([80.91.229.12]:38186) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Rljb0-0002tG-Dg for qemu-devel@nongnu.org; Fri, 13 Jan 2012 11:03:14 -0500 Received: from list by lo.gmane.org with local (Exim 4.69) (envelope-from ) id 1Rljaz-0006W9-1m for qemu-devel@nongnu.org; Fri, 13 Jan 2012 17:03:13 +0100 Received: from 93-34-200-238.ip51.fastwebnet.it ([93.34.200.238]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Fri, 13 Jan 2012 17:03:13 +0100 Received: from pbonzini by 93-34-200-238.ip51.fastwebnet.it with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Fri, 13 Jan 2012 17:03:13 +0100 From: Paolo Bonzini Date: Fri, 13 Jan 2012 16:56:17 +0100 Message-ID: References: <1324651143-5247-1-git-send-email-pbonzini@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit In-Reply-To: Subject: Re: [Qemu-devel] [PATCH] virtio-blk: refuse SG_IO requests with scsi=off List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org On 01/05/2012 11:05 AM, Paolo Bonzini wrote: > On 12/23/2011 03:39 PM, Paolo Bonzini wrote: >> QEMU does have a "scsi" option (to be used like -device >> virtio-blk-pci,drive=foo,scsi=off). However, it only >> masks the feature bit, and does not reject the command >> if a malicious guest disregards the feature bits and >> issues a request. >> >> Without this patch, using scsi=off does not protect you >> from CVE-2011-4127. >> >> Signed-off-by: Paolo Bonzini >> --- >> hw/virtio-blk.c | 6 ++++++ >> 1 files changed, 6 insertions(+), 0 deletions(-) >> >> diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c >> index b70d116..6cd3164 100644 >> --- a/hw/virtio-blk.c >> +++ b/hw/virtio-blk.c >> @@ -153,6 +153,12 @@ static void virtio_blk_handle_scsi(VirtIOBlockReq >> *req) >> int status; >> int i; >> >> + if ((req->dev->vdev.guest_features& (1<< VIRTIO_BLK_F_SCSI)) == 0) { >> + virtio_blk_req_complete(req, VIRTIO_BLK_S_UNSUPP); >> + g_free(req); >> + return; >> + } >> + >> /* >> * We require at least one output segment each for the virtio_blk_outhdr >> * and the SCSI command block. > > Ping. Ping^2 Paolo