diff options
| author | Prasad J Pandit <pjp@fedoraproject.org> | 2018-12-06 17:48:30 +0530 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2018-12-06 15:51:57 +0000 |
| commit | f2609ffdf39bcd4f89b5f67b33347490023a7a84 (patch) | |
| tree | b94cee05963faa9b5c705b9637bf71438a459dab /fsdev/qemu-fsdev.c | |
| parent | 80422b00196a7af4c6efb628fae0ad8b644e98af (diff) | |
| download | focaccia-qemu-f2609ffdf39bcd4f89b5f67b33347490023a7a84.tar.gz focaccia-qemu-f2609ffdf39bcd4f89b5f67b33347490023a7a84.zip | |
i2c: pm_smbus: check smb_index before block transfer write
While performing block transfer write in smb_ioport_writeb(), 'smb_index' is incremented and used to index smb_data[] array. Check 'smb_index' value to avoid OOB access. Note that this bug is exploitable by a guest to escape from the virtual machine. However the commit which introduced the bug was only made after the 3.0 release, and so it is not present in any released QEMU versions. Fixes: 38ad4fae43 i2c: pm_smbus: Add block transfer capability Reported-by: Michael Hanselmann <public@hansmi.ch> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Reviewed-by: Igor Mammedov <imammedo@redhat.com> Reviewed-by: Li Qiang <liq3ea@gmail.com> Reviewed-by: Michael Hanselmann <public@hansmi.ch> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Michael S. Tsirkin <mst@redhat.com> Message-id: 20181206121830.6177-1-ppandit@redhat.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'fsdev/qemu-fsdev.c')
0 files changed, 0 insertions, 0 deletions