diff options
| author | Thomas Huth <thuth@redhat.com> | 2023-05-22 11:10:11 +0200 |
|---|---|---|
| committer | Michael Tokarev <mjt@tls.msk.ru> | 2023-05-28 12:02:26 +0300 |
| commit | 9fe6e8139dc268f9916b8b7ce3ed9586c5354d11 (patch) | |
| tree | 263fb14579734ec6c736f619c4967a4e00eaae5b /linux-headers | |
| parent | 49d5fc4cfc420145aa203d14345bd1da48df1c9b (diff) | |
hw/scsi/lsi53c895a: Fix reentrancy issues in the LSI controller (CVE-2023-0330)
We cannot use the generic reentrancy guard in the LSI code, so
we have to manually prevent endless reentrancy here. The problematic
lsi_execute_script() function has already a way to detect whether
too many instructions have been executed - we just have to slightly
change the logic here that it also takes into account if the function
has been called too often in a reentrant way.
The code in fuzz-lsi53c895a-test.c has been taken from an earlier
patch by Mauro Matteo Cascella.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1563
Message-Id: <20230522091011.1082574-1-thuth@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit b987718bbb1d0eabf95499b976212dd5f0120d75)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Diffstat (limited to 'linux-headers')
0 files changed, 0 insertions, 0 deletions