[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 02/18] scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2
From: |
Paolo Bonzini |
Subject: |
[PULL 02/18] scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) |
Date: |
Tue, 12 Jul 2022 14:49:40 +0200 |
From: Mauro Matteo Cascella <mcascell@redhat.com>
Set current_req->req to NULL to prevent reusing a free'd buffer in case of
repeated SCSI cancel requests. Thanks to Thomas Huth for suggesting the patch.
Fixes: CVE-2022-0216
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220705200543.2366809-1-mcascell@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
hw/scsi/lsi53c895a.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c
index c8773f73f7..99ea42d49b 100644
--- a/hw/scsi/lsi53c895a.c
+++ b/hw/scsi/lsi53c895a.c
@@ -1028,8 +1028,9 @@ static void lsi_do_msgout(LSIState *s)
case 0x0d:
/* The ABORT TAG message clears the current I/O process only. */
trace_lsi_do_msgout_abort(current_tag);
- if (current_req) {
+ if (current_req && current_req->req) {
scsi_req_cancel(current_req->req);
+ current_req->req = NULL;
}
lsi_disconnect(s);
break;
--
2.36.1
- [PULL 00/18] Misc patches for 2022-07-12, Paolo Bonzini, 2022/07/12
- [PULL 01/18] tests/vm: do not specify -bios option, Paolo Bonzini, 2022/07/12
- [PULL 02/18] scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216),
Paolo Bonzini <=
- [PULL 07/18] configure: allow more host/target combos to use the host compiler, Paolo Bonzini, 2022/07/12
- [PULL 05/18] configure, pc-bios/s390-ccw: pass cross CFLAGS correctly, Paolo Bonzini, 2022/07/12
- [PULL 03/18] pc-bios/optionrom: use -m16 unconditionally, Paolo Bonzini, 2022/07/12
- [PULL 12/18] build: improve -fsanitize-coverage-allowlist check, Paolo Bonzini, 2022/07/12
- [PULL 14/18] audio/dbus: fix building, Paolo Bonzini, 2022/07/12
- [PULL 10/18] configure: pass whole target name to probe_target_compiler, Paolo Bonzini, 2022/07/12
- [PULL 09/18] tests/tcg: compile system emulation tests as freestanding, Paolo Bonzini, 2022/07/12
- [PULL 04/18] configure, pc-bios/optionrom: pass cross CFLAGS correctly, Paolo Bonzini, 2022/07/12
- [PULL 16/18] build: Do not depend on pc-bios for config-host.mak, Paolo Bonzini, 2022/07/12