From: Prasad J Pandit <p...@fedoraproject.org> When executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Exit such loop after reading 10k empty opcodes.
Reported-by: Bugs SysSec <bugs-sys...@rub.de> Signed-off-by: Prasad J Pandit <p...@fedoraproject.org> --- hw/scsi/lsi53c895a.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) Update v2: define LSI_MAX_INSN 10000 -> https://lists.gnu.org/archive/html/qemu-devel/2019-08/msg01370.html diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c index 10468c1ec1..2adab341b1 100644 --- a/hw/scsi/lsi53c895a.c +++ b/hw/scsi/lsi53c895a.c @@ -185,6 +185,9 @@ static const char *names[] = { /* Flag set if this is a tagged command. */ #define LSI_TAG_VALID (1 << 16) +/* Maximum instructions to process. */ +#define LSI_MAX_INSN 10000 + typedef struct lsi_request { SCSIRequest *req; uint32_t tag; @@ -1132,7 +1135,10 @@ static void lsi_execute_script(LSIState *s) s->istat1 |= LSI_ISTAT1_SRUN; again: - insn_processed++; + if (++insn_processed > LSI_MAX_INSN) { + s->waiting = LSI_NOWAIT; + goto exitloop; + } insn = read_dword(s, s->dsp); if (!insn) { /* If we receive an empty opcode increment the DSP by 4 bytes @@ -1569,7 +1575,8 @@ again: } } } - if (insn_processed > 10000 && s->waiting == LSI_NOWAIT) { +exitloop: + if (insn_processed > LSI_MAX_INSN && s->waiting == LSI_NOWAIT) { /* Some windows drivers make the device spin waiting for a memory location to change. If we have been executed a lot of code then assume this is the case and force an unexpected device disconnect. -- 2.21.0
