Skip to content
Commit da99530e authored by Prasad J Pandit's avatar Prasad J Pandit Committed by Michael Roth
Browse files

vmw_pvscsi: check page count while initialising descriptor rings



Vmware Paravirtual SCSI emulation uses command descriptors to
process SCSI commands. These descriptors come with their ring
buffers. A guest could set the page count for these rings to
an arbitrary value, leading to infinite loop or OOB access.
Add check to avoid it.

Reported-by: default avatarTom Victor <vv474172261@gmail.com>
Signed-off-by: default avatarPrasad J Pandit <pjp@fedoraproject.org>
Message-Id: <1472626169-12989-1-git-send-email-ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 7f61f469)
Signed-off-by: default avatarMichael Roth <mdroth@linux.vnet.ibm.com>
parent 7aa7c251
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment