Re: [PATCH] xen/scsifront: check for a NULL shadow entry on a backend response

[Jürgen Groß]

On 05.10.26 14:35, Yehyeong Lee wrote:
> scsifront_do_response() validates the rqid in a backend response against
> VSCSIIF_MAX_REQS before using it to index info->shadow[], but then
> dereferences the entry to test ->inflight without checking that the slot
> is populated.  Shadow slots are NULL before a command is submitted (the
> host private area is zeroed at allocation) and are reset to NULL in
> _scsifront_put_rqid() once a request completes, so an in-range rqid that
> does not correspond to an outstanding request makes the frontend
> dereference a NULL pointer.
>
> A malicious or buggy backend can thus crash the guest by returning a
> response whose rqid is in range but not in flight -- for example a
> spurious response before any command has been issued, or a duplicate of
> one already completed.  The ring has only VSCSIIF_MAX_REQS (16) slots, so
> before the first command every in-range rqid selects a NULL slot.
>
> Reject a response whose shadow slot is not populated.
>
> Fixes: 6d1c2f48f3fc ("xen/scsifront: harden driver against malicious backend")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Yehyeong Lee <yhlee@xxxxxxxxxxxxxxxxxx>

Reviewed-by: Juergen Gross <jgross@xxxxxxxx>


Juergen

Attachment: OpenPGP_0xB0DE9DD628BF132F.asc
Description: OpenPGP public key

Attachment: OpenPGP_signature.asc
Description: OpenPGP digital signature