From: Soumyajyotii Ssarkar <[email protected]> Add nullpointer safety checks in ncr710_request_free() and ncr710_request_cancelled() to prevent crashed while handing invalid req structures.
Added to preventing memory corruption, which occured during device initialization. Signed-off-by: Soumyajyotii Ssarkar <[email protected]> Reviewed-by: Helge Deller <[email protected]> Signed-off-by: Helge Deller <[email protected]> --- hw/scsi/ncr53c710.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/hw/scsi/ncr53c710.c b/hw/scsi/ncr53c710.c index 47a6983491..bab2ea7210 100644 --- a/hw/scsi/ncr53c710.c +++ b/hw/scsi/ncr53c710.c @@ -737,6 +737,12 @@ static void ncr710_add_msg_byte(NCR710State *s, uint8_t data) static void ncr710_request_free(NCR710State *s, NCR710Request *p) { + if (!p) { + return; + } + if (p->req && p->req->hba_private == p) { + p->req->hba_private = NULL; + } if (p == s->current) { s->current = NULL; } @@ -747,8 +753,11 @@ void ncr710_request_cancelled(SCSIRequest *req) { NCR710State *s = ncr710_from_scsi_bus(req->bus); NCR710Request *p = (NCR710Request *)req->hba_private; - req->hba_private = NULL; - ncr710_request_free(s, p); + if (p) { + req->hba_private = NULL; + p->req = NULL; + ncr710_request_free(s, p); + } scsi_req_unref(req); } -- 2.52.0
