[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PATCH v2 5/6] esp: always check current_req is not NULL before use in D
From: |
Mark Cave-Ayland |
Subject: |
[PATCH v2 5/6] esp: always check current_req is not NULL before use in DMA callbacks |
Date: |
Wed, 17 Mar 2021 23:02:22 +0000 |
After issuing a SCSI command the SCSI layer can call the SCSIBusInfo .cancel
callback which resets both current_req and current_dev to NULL. If any data
is left in the transfer buffer (async_len != 0) then the next TI (Transfer
Information) command will attempt to reference the NULL pointer causing a
segfault.
Buglink: https://bugs.launchpad.net/qemu/+bug/1910723
Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
hw/scsi/esp.c | 19 ++++++++++++++-----
1 file changed, 14 insertions(+), 5 deletions(-)
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index bb57125035..d7b81b7608 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -505,6 +505,10 @@ static void do_dma_pdma_cb(ESPState *s)
return;
}
+ if (!s->current_req) {
+ return;
+ }
+
if (to_device) {
/* Copy FIFO data to device */
len = MIN(s->async_len, ESP_FIFO_SZ);
@@ -538,11 +542,9 @@ static void do_dma_pdma_cb(ESPState *s)
return;
} else {
if (s->async_len == 0) {
- if (s->current_req) {
- /* Defer until the scsi layer has completed */
- scsi_req_continue(s->current_req);
- s->data_in_ready = false;
- }
+ /* Defer until the scsi layer has completed */
+ scsi_req_continue(s->current_req);
+ s->data_in_ready = false;
return;
}
@@ -616,6 +618,9 @@ static void esp_do_dma(ESPState *s)
}
return;
}
+ if (!s->current_req) {
+ return;
+ }
if (s->async_len == 0) {
/* Defer until data is available. */
return;
@@ -725,6 +730,10 @@ static void esp_do_nodma(ESPState *s)
return;
}
+ if (!s->current_req) {
+ return;
+ }
+
if (s->async_len == 0) {
/* Defer until data is available. */
return;
--
2.20.1
- [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer, Mark Cave-Ayland, 2021/03/17
- [PATCH v2 1/6] esp: don't underflow cmdfifo if no message out/command data is present, Mark Cave-Ayland, 2021/03/17
- [PATCH v2 2/6] esp: don't overflow cmdfifo if TC is larger than the cmdfifo size, Mark Cave-Ayland, 2021/03/17
- [PATCH v2 3/6] esp: ensure cmdfifo is not empty and current_dev is non-NULL, Mark Cave-Ayland, 2021/03/17
- [PATCH v2 4/6] esp: don't underflow fifo when writing to the device, Mark Cave-Ayland, 2021/03/17
- [PATCH v2 5/6] esp: always check current_req is not NULL before use in DMA callbacks,
Mark Cave-Ayland <=
- [PATCH v2 6/6] tests/qtest: add tests for am53c974 device, Mark Cave-Ayland, 2021/03/17
- Re: [PATCH v2 0/6] esp: fix asserts/segfaults discovered by fuzzer, Paolo Bonzini, 2021/03/18