[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-commits] [qemu/qemu] 379164: mptsas: Remove unused MPTSASState 'pe

From: Paolo Bonzini
Subject: [Qemu-commits] [qemu/qemu] 379164: mptsas: Remove unused MPTSASState 'pending' field ...
Date: Mon, 19 Apr 2021 09:47:52 -0700

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: 3791642c8d60029adf9b00bcb4e34d7d8a1aea4d
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   2021-04-19 (Mon, 19 Apr 2021)

  Changed paths:
    M hw/scsi/mptsas.c
    M hw/scsi/mptsas.h

  Log Message:
  mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)

While processing SCSI i/o requests in mptsas_process_scsi_io_request(),
the Megaraid emulator appends new MPTSASRequest object 'req' to
the 's->pending' queue. In case of an error, this same object gets
dequeued in mptsas_free_request() only if SCSIRequest object
'req->sreq' is initialised. This may lead to a use-after-free issue.

Since s->pending is actually not used, simply remove it from

Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Message-id: 20210419134247.1467982-1-f4bug@amsat.org
Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392)
Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device")
[PMD: Reworded description, added more tags]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

reply via email to

[Prev in Thread] Current Thread [Next in Thread]