|
 |
57359f7 |
From 926cde5f3e4d2504ed161ed0cb771ac7cad6fd11 Mon Sep 17 00:00:00 2001
|
|
|
57359f7 |
From: Prasad J Pandit <pjp@fedoraproject.org>
|
|
|
57359f7 |
Date: Thu, 16 Jun 2016 00:22:35 +0200
|
|
|
57359f7 |
Subject: [PATCH] scsi: esp: make cmdbuf big enough for maximum CDB size
|
|
|
57359f7 |
|
|
|
57359f7 |
While doing DMA read into ESP command buffer 's->cmdbuf', it could
|
|
|
57359f7 |
write past the 's->cmdbuf' area, if it was transferring more than 16
|
|
|
57359f7 |
bytes. Increase the command buffer size to 32, which is maximum when
|
|
|
57359f7 |
's->do_cmd' is set, and add a check on 'len' to avoid OOB access.
|
|
|
57359f7 |
|
|
|
57359f7 |
Reported-by: Li Qiang <liqiang6-s@360.cn>
|
|
|
57359f7 |
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
|
|
|
57359f7 |
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
|
|
|
57359f7 |
---
|
|
|
57359f7 |
hw/esp.c | 6 ++++--
|
|
|
57359f7 |
hw/esp.c | 3 ++-
|
|
|
57359f7 |
2 files changed, 6 insertions(+), 3 deletions(-)
|
|
|
57359f7 |
|
|
|
57359f7 |
diff --git a/hw/esp.c b/hw/esp.c
|
|
|
57359f7 |
index 64680b3..baa0a2c 100644
|
|
|
57359f7 |
--- a/hw/esp.c
|
|
|
57359f7 |
+++ b/hw/esp.c
|
|
|
57359f7 |
@@ -25,6 +25,7 @@
|
|
|
57359f7 |
#include "hw.h"
|
|
|
57359f7 |
#include "scsi-disk.h"
|
|
|
57359f7 |
#include "scsi.h"
|
|
|
57359f7 |
+#include <assert.h>
|
|
|
57359f7 |
|
|
|
57359f7 |
/* debug ESP card */
|
|
|
57359f7 |
//#define DEBUG_ESP
|
|
|
57359f7 |
@@ -248,6 +248,8 @@ static void esp_do_dma(ESPState *s)
|
|
|
57359f7 |
len = s->dma_left;
|
|
|
57359f7 |
if (s->do_cmd) {
|
|
|
57359f7 |
DPRINTF("command len %d + %d\n", s->cmdlen, len);
|
|
|
57359f7 |
+ assert (s->cmdlen <= sizeof(s->cmdbuf) &&
|
|
|
57359f7 |
+ len <= sizeof(s->cmdbuf) - s->cmdlen);
|
|
|
57359f7 |
s->dma_memory_read(s->dma_opaque, &s->cmdbuf[s->cmdlen], len);
|
|
|
57359f7 |
s->ti_size = 0;
|
|
|
57359f7 |
s->cmdlen = 0;
|
|
|
57359f7 |
@@ -345,7 +347,7 @@ static void handle_ti(ESPState *s)
|
|
|
57359f7 |
s->dma_counter = dmalen;
|
|
|
57359f7 |
|
|
|
57359f7 |
if (s->do_cmd)
|
|
|
57359f7 |
- minlen = (dmalen < 32) ? dmalen : 32;
|
|
|
57359f7 |
+ minlen = (dmalen < ESP_CMDBUF_SZ) ? dmalen : ESP_CMDBUF_SZ;
|
|
|
57359f7 |
else if (s->ti_size < 0)
|
|
|
57359f7 |
minlen = (dmalen < -s->ti_size) ? dmalen : -s->ti_size;
|
|
|
57359f7 |
else
|
|
|
57359f7 |
@@ -449,7 +451,7 @@ void esp_reg_write(ESPState *s, uint32_t saddr, uint64_t val)
|
|
|
57359f7 |
break;
|
|
|
57359f7 |
case ESP_FIFO:
|
|
|
57359f7 |
if (s->do_cmd) {
|
|
|
57359f7 |
- if (s->cmdlen < TI_BUFSZ) {
|
|
|
57359f7 |
+ if (s->cmdlen < ESP_CMDBUF_SZ) {
|
|
|
57359f7 |
s->cmdbuf[s->cmdlen++] = val & 0xff;
|
|
|
57359f7 |
} else {
|
|
|
57359f7 |
ESP_ERROR("fifo overrun\n");
|
|
|
57359f7 |
diff --git a/hw/esp.c b/hw/esp.c
|
|
|
57359f7 |
index 6c79527..d2c4886 100644
|
|
|
57359f7 |
--- a/hw/esp.c
|
|
|
57359f7 |
+++ b/hw/esp.c
|
|
|
57359f7 |
@@ -14,6 +14,7 @@ void esp_init(hwaddr espaddr, int it_shift,
|
|
|
57359f7 |
|
|
|
57359f7 |
#define ESP_REGS 16
|
|
|
57359f7 |
#define TI_BUFSZ 16
|
|
|
57359f7 |
+#define ESP_CMDBUF_SZ 32
|
|
|
57359f7 |
|
|
|
57359f7 |
typedef struct ESPState ESPState;
|
|
|
57359f7 |
|
|
|
57359f7 |
@@ -31,7 +32,7 @@ struct ESPState {
|
|
|
57359f7 |
uint32_t dma;
|
|
|
57359f7 |
SCSIDevice *scsi_dev[ESP_MAX_DEVS];
|
|
|
57359f7 |
SCSIDevice *current_dev;
|
|
|
57359f7 |
- uint8_t cmdbuf[TI_BUFSZ];
|
|
|
57359f7 |
+ uint8_t cmdbuf[ESP_CMDBUF_SZ];
|
|
|
57359f7 |
uint32_t cmdlen;
|
|
|
57359f7 |
uint32_t do_cmd;
|
|
|
57359f7 |
|
|
|
57359f7 |
--
|
|
|
57359f7 |
1.7.0.4
|
|
|
57359f7 |
|