From: Laszlo Ersek Date: Sat, 2 Nov 2013 19:14:21 +0000 (+0100) Subject: scsi_target_send_command(): amend stable-1.6 port of the CVE-2013-4344 fix X-Git-Tag: qemu-xen-4.4.0-rc3~4 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=192d2f4cc7931668d4e4f10e882af3c097193c47;p=qemu-upstream-4.4-testing.git scsi_target_send_command(): amend stable-1.6 port of the CVE-2013-4344 fix The originally suggested fix for CVE-2013-4344 introduced a regression in scsi_target_send_command() / REQUEST_SENSE; the third argument passed to scsi_device_get_sense() -- for the "len" parameter -- ignored the possibility of the guest SCSI driver requesting truncated (or shorter than full) sense data. This could result in (r->len > req->cmd.xfer) on return, which is not valid SCSI. The problem was addressed in the second round, and the commit on the master branch (84642435) is correct. However the stable-1.6 branch (the v1.6.1 release) has the original, regressive fix (commit fdcbe7d5); let's update it. Signed-off-by: Laszlo Ersek Reviewed-by: Paolo Bonzini Signed-off-by: Michael Roth --- diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c index ad26c252e..d352da702 100644 --- a/hw/scsi/scsi-bus.c +++ b/hw/scsi/scsi-bus.c @@ -460,7 +460,8 @@ static int32_t scsi_target_send_command(SCSIRequest *req, uint8_t *buf) break; case REQUEST_SENSE: scsi_target_alloc_buf(&r->req, SCSI_SENSE_LEN); - r->len = scsi_device_get_sense(r->req.dev, r->buf, r->buf_len, + r->len = scsi_device_get_sense(r->req.dev, r->buf, + MIN(req->cmd.xfer, r->buf_len), (req->cmd.buf[1] & 1) == 0); if (r->req.dev->sense_is_ua) { scsi_device_unit_attention_reported(req->dev);