Hi Prasad, On 8/13/19 12:05 PM, P J P wrote: > +-- On Fri, 9 Aug 2019, P J P wrote --+ > | From: Prasad J Pandit <p...@fedoraproject.org> > | > | When executing script in lsi_execute_script(), the LSI scsi > | adapter emulator advances 's->dsp' index to read next opcode. > | This can lead to an infinite loop if the next opcode is empty. > | Exit such loop after reading 10k empty opcodes. > | > | Reported-by: Bugs SysSec <bugs-sys...@rub.de> > | Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> > | --- > | hw/scsi/lsi53c895a.c | 11 ++++++++++- > | 1 file changed, 10 insertions(+), 1 deletion(-) > | > | Update v3: raise an illegal instruction interrupt and exit > | -> https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01427.html > | > | diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c > | index 10468c1ec1..e703ef4c9d 100644 > | --- a/hw/scsi/lsi53c895a.c > | +++ b/hw/scsi/lsi53c895a.c > | @@ -185,6 +185,9 @@ static const char *names[] = { > | /* Flag set if this is a tagged command. */ > | #define LSI_TAG_VALID (1 << 16) > | > | +/* Maximum instructions to process. */ > | +#define LSI_MAX_INSN 10000 > | + > | typedef struct lsi_request { > | SCSIRequest *req; > | uint32_t tag; > | @@ -1132,7 +1135,13 @@ static void lsi_execute_script(LSIState *s) > | > | s->istat1 |= LSI_ISTAT1_SRUN; > | again: > | - insn_processed++; > | + if (++insn_processed > LSI_MAX_INSN) { > | + trace_lsi_execute_script_tc_illegal(); > | + lsi_script_dma_interrupt(s, LSI_DSTAT_IID); > | + lsi_disconnect(s); > | + trace_lsi_execute_script_stop(); > | + return;
My understanding of Marcelo's explanation (https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01427.html) is we can kill insn_processed. > | + } > | insn = read_dword(s, s->dsp); > | if (!insn) { > | /* If we receive an empty opcode increment the DSP by 4 bytes > | > > Ping...?! > -- > Prasad J Pandit / Red Hat Product Security Team > 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B 041F >