File esp-always-check-current_req-is-not-NULL.patch of Package qemu.28166

Overview Repositories Revisions Requests Users Attributes Meta

File esp-always-check-current_req-is-not-NULL.patch of Package qemu.28166

From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Wed, 7 Apr 2021 20:57:50 +0100
Subject: esp: always check current_req is not NULL before use in DMA callbacks

Git-commit: 0db895361b8a82e1114372ff9f4857abea605701
References: bsc#1180433, CVE-2020-35504
            bsc#1180434, CVE-2020-35505
            bsc#1180435, CVE-2020-35506

After issuing a SCSI command the SCSI layer can call the SCSIBusInfo .cancel
callback which resets both current_req and current_dev to NULL. If any data
is left in the transfer buffer (async_len != 0) then the next TI (Transfer
Information) command will attempt to reference the NULL pointer causing a
segfault.

Buglink: https://bugs.launchpad.net/qemu/+bug/1910723
Buglink: https://bugs.launchpad.net/qemu/+bug/1909247
Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Alexander Bulekov <alxndr@bu.edu>
Message-Id: <20210407195801.685-2-mark.cave-ayland@ilande.co.uk>
Signed-off-by: Jose R Ziviani <jose.ziviani@suse.com>
---
 hw/scsi/esp.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index b84e0fe33e9e18446eda28786e8f..a45de5e09572affbbfbe88acd717 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -365,6 +365,11 @@ static void do_dma_pdma_cb(ESPState *s)
     s->dma_left -= len;
     s->async_buf += len;
     s->async_len -= len;
+
+    if (!s->current_req) {
+        return;
+    }
+
     if (to_device) {
         s->ti_size += len;
     } else {
@@ -415,6 +420,9 @@ static void esp_do_dma(ESPState *s)
         do_cmd(s, s->cmdbuf);
         return;
     }
+    if (!s->current_req) {
+        return;
+    }
     if (s->async_len == 0) {
         /* Defer until data is available.  */
         return;

Places

File esp-always-check-current_req-is-not-NULL.patch of Package qemu.28166

Places