+-- On Wed, 7 Sep 2016, P J P wrote --+
| From: Prasad J Pandit <p...@fedoraproject.org>
|
| Vmware Paravirtual SCSI emulator while processing IO requests
| could run into an infinite loop if 'pvscsi_ring_pop_req_descr'
| always returned positive value. Limit IO loop to the maximum
| page count.
|
| Reported-by: Li Qiang <liqiang...@360.cn>
| Signed-off-by: Prasad J Pandit <p...@fedoraproject.org>
| ---
| hw/scsi/vmw_pvscsi.c | 4 +++-
| 1 file changed, 3 insertions(+), 1 deletion(-)
|
| diff --git a/hw/scsi/vmw_pvscsi.c b/hw/scsi/vmw_pvscsi.c
| index babac5a..3e77a08 100644
| --- a/hw/scsi/vmw_pvscsi.c
| +++ b/hw/scsi/vmw_pvscsi.c
| @@ -711,11 +711,13 @@ pvscsi_process_request_descriptor(PVSCSIState *s,
| static void
| pvscsi_process_io(PVSCSIState *s)
| {
| + int descr_pa_cnt = 0;
| PVSCSIRingReqDesc descr;
| hwaddr next_descr_pa;
|
| assert(s->rings_info_valid);
| - while ((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0) {
| + while (((next_descr_pa = pvscsi_ring_pop_req_descr(&s->rings)) != 0)
| + && descr_pa_cnt++ < PVSCSI_SETUP_RINGS_MAX_NUM_PAGES) {
|
| /* Only read after production index verification */
| smp_rmb();
Ping...!
--
Prasad J Pandit / Red Hat Product Security Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F
