vmw_pvscsi: check page count while initialising descriptor rings
Vmware Paravirtual SCSI emulation uses command descriptors to process SCSI commands. These descriptors come with their ring buffers. A guest could set the page count for these rings to an arbitrary value, leading to infinite loop or OOB access. Add check to avoid it. Reported-by:Tom Victor <vv474172261@gmail.com> Signed-off-by:
Prasad J Pandit <pjp@fedoraproject.org> Message-Id: <1472626169-12989-1-git-send-email-ppandit@redhat.com> Cc: qemu-stable@nongnu.org Signed-off-by:
Paolo Bonzini <pbonzini@redhat.com> (cherry picked from commit 7f61f469) Signed-off-by:
Michael Roth <mdroth@linux.vnet.ibm.com>
Loading
Please register or sign in to comment