diff options
| author | Alexandra Diupina <adiupina@astralinux.ru> | 2023-12-29 18:26:47 +0300 |
|---|---|---|
| committer | Paolo Bonzini <pbonzini@redhat.com> | 2023-12-31 09:11:27 +0100 |
| commit | b22f83d8df481800ce43d1915a98c127a9de2258 (patch) | |
| tree | a849624c823ce87bad6c7b6e808f73e08a79394b /hw/scsi | |
| parent | 219615740425d9683588207b40a365e6741691a6 (diff) | |
| download | qemu-b22f83d8df481800ce43d1915a98c127a9de2258.zip qemu-b22f83d8df481800ce43d1915a98c127a9de2258.tar.gz qemu-b22f83d8df481800ce43d1915a98c127a9de2258.tar.bz2 | |
esp: check for NULL result from scsi_device_find()
Add a 'current_lun' check for a null value
to avoid null pointer dereferencing and
recover host if NULL return
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase)
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
Message-ID: <20231229152647.19699-1-adiupina@astralinux.ru>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/scsi')
| -rw-r--r-- | hw/scsi/esp.c | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index 9b11d8c..d2cae79 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -292,6 +292,15 @@ static void do_command_phase(ESPState *s) esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen); current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun); + if (!current_lun) { + /* No such drive */ + s->rregs[ESP_RSTAT] = 0; + s->rregs[ESP_RINTR] = INTR_DC; + s->rregs[ESP_RSEQ] = SEQ_0; + esp_raise_irq(s); + return; + } + s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s); datalen = scsi_req_enqueue(s->current_req); s->ti_size = datalen; |