diff options
| author | Mauro Matteo Cascella <mcascell@redhat.com> | 2022-07-05 22:05:43 +0200 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2022-07-06 09:31:15 +0200 |
| commit | 6c8fa961da5e60f574bb52fd3ad44b1e9e8ad4b8 (patch) | |
| tree | 1fa7da9a1dd2ff4a47879164df8331430d0aae70 | |
| parent | 170ed475cd5f78261c56cebf12541ceee4807594 (diff) | |
| download | qemu-6c8fa961da5e60f574bb52fd3ad44b1e9e8ad4b8.zip qemu-6c8fa961da5e60f574bb52fd3ad44b1e9e8ad4b8.tar.gz qemu-6c8fa961da5e60f574bb52fd3ad44b1e9e8ad4b8.tar.bz2 | |
scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)
Set current_req->req to NULL to prevent reusing a free'd buffer in case of
repeated SCSI cancel requests. Thanks to Thomas Huth for suggesting the patch.
Fixes: CVE-2022-0216
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220705200543.2366809-1-mcascell@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
| -rw-r--r-- | hw/scsi/lsi53c895a.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c index c8773f7..99ea42d 100644 --- a/hw/scsi/lsi53c895a.c +++ b/hw/scsi/lsi53c895a.c @@ -1028,8 +1028,9 @@ static void lsi_do_msgout(LSIState *s) case 0x0d: /* The ABORT TAG message clears the current I/O process only. */ trace_lsi_do_msgout_abort(current_tag); - if (current_req) { + if (current_req && current_req->req) { scsi_req_cancel(current_req->req); + current_req->req = NULL; } lsi_disconnect(s); break; |