Sign Up
Log In
Log In
or
Sign Up
Places
All Projects
Status Monitor
Collapse sidebar
SUSE:SLE-15-SP7:Update
qemu.29315
esp-always-check-current_req-is-not-NULL.patch
Overview
Repositories
Revisions
Requests
Users
Attributes
Meta
File esp-always-check-current_req-is-not-NULL.patch of Package qemu.29315
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Date: Wed, 7 Apr 2021 20:57:50 +0100 Subject: esp: always check current_req is not NULL before use in DMA callbacks Git-commit: 0db895361b8a82e1114372ff9f4857abea605701 References: bsc#1180433, CVE-2020-35504 bsc#1180434, CVE-2020-35505 bsc#1180435, CVE-2020-35506 After issuing a SCSI command the SCSI layer can call the SCSIBusInfo .cancel callback which resets both current_req and current_dev to NULL. If any data is left in the transfer buffer (async_len != 0) then the next TI (Transfer Information) command will attempt to reference the NULL pointer causing a segfault. Buglink: https://bugs.launchpad.net/qemu/+bug/1910723 Buglink: https://bugs.launchpad.net/qemu/+bug/1909247 Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20210407195801.685-2-mark.cave-ayland@ilande.co.uk> Signed-off-by: Jose R Ziviani <jose.ziviani@suse.com> --- hw/scsi/esp.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index b84e0fe33e9e18446eda28786e8f..a45de5e09572affbbfbe88acd717 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -365,6 +365,11 @@ static void do_dma_pdma_cb(ESPState *s) s->dma_left -= len; s->async_buf += len; s->async_len -= len; + + if (!s->current_req) { + return; + } + if (to_device) { s->ti_size += len; } else { @@ -415,6 +420,9 @@ static void esp_do_dma(ESPState *s) do_cmd(s, s->cmdbuf); return; } + if (!s->current_req) { + return; + } if (s->async_len == 0) { /* Defer until data is available. */ return;
Locations
Projects
Search
Status Monitor
Help
OpenBuildService.org
Documentation
API Documentation
Code of Conduct
Contact
Support
@OBShq
Terms
openSUSE Build Service is sponsored by
The Open Build Service is an
openSUSE project
.
Sign Up
Log In
Places
Places
All Projects
Status Monitor