qemu/hw
Mauro Matteo Cascella b3af7fdf9c hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands
This avoids an off-by-one read of 'mode_sense_valid' buffer in
hw/scsi/scsi-disk.c:mode_sense_page().

Fixes: CVE-2021-3930
Cc: qemu-stable@nongnu.org
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: a8f4bbe290 ("scsi-disk: store valid mode pages in a table")
Fixes: #546
Reported-by: Qiuhao Li <Qiuhao.Li@outlook.com>
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2021-11-08 08:55:29 +01:00
..
9pfs 9pfs: use P9Array in v9fs_walk() 2021-10-27 14:45:22 +02:00
acpi hw/acpi: Add VIOT table 2021-11-01 18:49:10 -04:00
adc hw/adc: Add basic Aspeed ADC model 2021-10-12 08:20:08 +02:00
alpha hw/alpha: Provide a PCI-ISA bridge device node 2021-06-28 07:27:32 -07:00
arm hw/arm/virt: Rename default_bus_bypass_iommu 2021-11-02 14:14:55 -04:00
audio qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
avr hw/avr/atmega.c: use the avr51 cpu for atmega1280 2021-05-13 19:11:42 +02:00
block qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
char hw/char/sh_serial: Add device id to trace output 2021-10-30 18:39:37 +02:00
core Fix virtio-net-pci* "vectors" compat 2021-11-05 11:32:00 +08:00
cpu cpu/core: Fix "help" of CPU core device types 2021-04-09 16:05:16 -04:00
cris Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
display virtio-gpu: splitting one extended mode guest fb into n-scanouts 2021-11-05 12:29:19 +01:00
dma hw/dma: sifive_pdma: Don't run DMA when channel is disclaimed 2021-10-07 08:41:33 +10:00
gpio hw: aspeed_gpio: Fix GPIO array indexing 2021-10-12 08:20:08 +02:00
hppa docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
hyperv qbus: Rename qbus_create() to qbus_new() 2021-09-30 13:44:08 +01:00
i2c aspeed/i2c: QOMify AspeedI2CBus 2021-10-12 08:20:08 +02:00
i386 * Build system fixes and cleanups 2021-11-03 13:07:30 -04:00
ide ide: Cap LBA28 capacity announcement to 2^28-1 2021-11-02 13:02:46 +01:00
input hw/input/lasips2: Fix typos in function names 2021-10-31 21:05:40 +01:00
intc hw/intc/sh_intc: Remove unneeded local variable initialisers 2021-10-30 18:39:37 +02:00
ipack qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
ipmi ipmi/sim: fix watchdog_expired data type error in IPMIBmcSim struct 2021-07-08 14:15:01 -05:00
isa vt82c686: Add a method to VIA_ISA to raise ISA interrupts 2021-10-18 00:41:36 +02:00
m68k q800: drop 8-bit graphic_depth check for Apple 21 inch display 2021-10-20 16:25:04 +02:00
mem kconfig: split CONFIG_SPARSE_MEM from fuzzing 2021-10-14 09:50:56 +02:00
microblaze Do not include sysemu/sysemu.h if it's not really necessary 2021-05-02 17:24:50 +02:00
mips hw/mips/boston: Add FDT generator 2021-10-18 00:41:36 +02:00
misc hw/misc: deprecate the 'sga' device 2021-11-02 17:24:18 +01:00
net e1000: fix tx re-entrancy problem 2021-11-05 11:31:42 +08:00
nios2 Do not include cpu.h if it's not really necessary 2021-05-02 17:24:51 +02:00
nubus qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
nvme qbus: Rename qbus_create_inplace() to qbus_init() 2021-09-30 13:42:10 +01:00
nvram hw/nvram: Fix Memory Leak in Xilinx ZynqMP eFuse device 2021-10-23 18:50:33 +02:00
openrisc Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
pci pci: Export pci_for_each_device_under_bus*() 2021-11-01 19:36:11 -04:00
pci-bridge qdev: Make DeviceState.id independent of QemuOpts 2021-10-15 16:06:35 +02:00
pci-host hw/sh4: Coding style: White space fixes 2021-10-30 11:46:40 +02:00
pcmcia hw/pcmcia: Do not register PCMCIA type if not required 2021-05-02 17:24:50 +02:00
ppc pci: Export pci_for_each_device_under_bus*() 2021-11-01 19:36:11 -04:00
rdma qapi: introduce x-query-rdma QMP command 2021-11-02 15:55:14 +00:00
remote hw/remote/proxy: Categorize Wireless devices as 'Network' ones 2021-10-04 09:47:26 +02:00
riscv hw/riscv: opentitan: Fixup the PLIC context addresses 2021-10-28 14:39:23 +10:00
rtc docs: fix references to docs/devel/tracing.rst 2021-06-02 06:51:09 +02:00
rx hw/rx/rx-gdbsim: Do not accept invalid memory size 2021-05-03 10:07:41 +02:00
s390x pci: Export pci_for_each_device_under_bus*() 2021-11-01 19:36:11 -04:00
scsi hw/scsi/scsi-disk: MODE_PAGE_ALLS not allowed in MODE SELECT commands 2021-11-08 08:55:29 +01:00
sd hw/sd: add nuvoton MMC 2021-11-02 14:14:55 -04:00
sensor hw/misc: Add Infineon DPS310 sensor model 2021-09-20 08:50:59 +02:00
sh4 hw/intc/sh_intc: Inline and drop sh_intc_source() function 2021-10-30 18:39:37 +02:00
smbios hw/smbios: support for type 41 (onboard devices extended information) 2021-05-14 10:26:18 -04:00
sparc sun4m: fix setting CPU id when more than one CPU is present 2021-09-08 11:09:45 +01:00
sparc64 hw/block/fdc: Extract ISA floppy controllers to fdc-isa.c 2021-06-25 08:53:28 -04:00
ssi aspeed/smc: Use a container for the flash mmio address space 2021-10-22 09:52:17 +02:00
timer hw/timer/sh_timer: Remove use of hw_error 2021-10-30 18:39:37 +02:00
tpm tpm: mark correct memory region range dirty when clearing RAM 2021-10-02 08:43:21 +02:00
tricore hw/tricore: fix inclusion of tricore_testboard 2021-07-20 20:10:21 +02:00
usb Initial conversion of HMP debugging commands to QMP 2021-11-03 08:04:32 -04:00
vfio vfio/common: Add a trace point when a MMIO RAM section cannot be mapped 2021-11-01 12:17:51 -06:00
virtio pc,pci,virtio: features, fixes 2021-11-02 19:24:17 -04:00
watchdog watchdog: remove select_watchdog_action 2021-11-02 15:57:27 +01:00
xen pci: Export pci_for_each_device_under_bus*() 2021-11-01 19:36:11 -04:00
xenpv
xtensa Do not include exec/address-spaces.h if it's not really necessary 2021-05-02 17:24:51 +02:00
Kconfig hw/arm: xlnx-zcu102: Add Xilinx eFUSE device 2021-09-30 13:42:10 +01:00
meson.build sensor: Move hardware sensors from misc to a sensor directory 2021-06-17 07:10:32 -05:00