diff options
| author | Michael Tokarev <mjt@tls.msk.ru> | 2021-04-19 15:42:47 +0200 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2021-04-19 15:48:12 +0100 |
| commit | 3791642c8d60029adf9b00bcb4e34d7d8a1aea4d (patch) | |
| tree | 2862f9c74393b4587706c0b1d597263af0c776b3 /hw/scsi/mptsas.h | |
| parent | 0c5393a1349a72013b577dae0e1b8c9a20d277f4 (diff) | |
mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)
While processing SCSI i/o requests in mptsas_process_scsi_io_request(),
the Megaraid emulator appends new MPTSASRequest object 'req' to
the 's->pending' queue. In case of an error, this same object gets
dequeued in mptsas_free_request() only if SCSIRequest object
'req->sreq' is initialised. This may lead to a use-after-free issue.
Since s->pending is actually not used, simply remove it from
MPTSASState.
Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Message-id: 20210419134247.1467982-1-f4bug@amsat.org
Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392)
Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device")
[PMD: Reworded description, added more tags]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Diffstat (limited to 'hw/scsi/mptsas.h')
| -rw-r--r-- | hw/scsi/mptsas.h | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/hw/scsi/mptsas.h b/hw/scsi/mptsas.h index b85ac1a5fc..c046497db7 100644 --- a/hw/scsi/mptsas.h +++ b/hw/scsi/mptsas.h @@ -79,7 +79,6 @@ struct MPTSASState { uint16_t reply_frame_size; SCSIBus bus; - QTAILQ_HEAD(, MPTSASRequest) pending; }; void mptsas_fix_scsi_io_endianness(MPIMsgSCSIIORequest *req); |