6b7fa3cbab
We are doing things like
nb_sectors /= (s->qdev.blocksize / BDRV_SECTOR_SIZE);
in the code here (e.g. in scsi_disk_emulate_mode_sense()), so if
the blocksize is smaller than BDRV_SECTOR_SIZE (=512), this crashes
with a division by 0 exception. Thus disallow block sizes of 256
bytes to avoid this situation.
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1813
CVE: 2023-42467
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20230925091854.49198-1-thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 7cfcc79b0ab800959716738aff9419f53fc68c9c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
|
||
|---|---|---|
| .. | ||
| emulation.c | ||
| esp-pci.c | ||
| esp.c | ||
| Kconfig | ||
| lsi53c895a.c | ||
| megasas.c | ||
| meson.build | ||
| mfi.h | ||
| mpi.h | ||
| mptconfig.c | ||
| mptendian.c | ||
| mptsas.c | ||
| mptsas.h | ||
| scsi-bus.c | ||
| scsi-disk.c | ||
| scsi-generic.c | ||
| spapr_vscsi.c | ||
| srp.h | ||
| trace-events | ||
| trace.h | ||
| vhost-scsi-common.c | ||
| vhost-scsi.c | ||
| vhost-user-scsi.c | ||
| viosrp.h | ||
| virtio-scsi-dataplane.c | ||
| virtio-scsi.c | ||
| vmw_pvscsi.c | ||
| vmw_pvscsi.h | ||