On Sun, 18 Apr 2021 at 06:30, Philippe Mathieu-Daudé <phi...@redhat.com> wrote:
>
> From: Michael Tokarev <m...@tls.msk.ru>
>
> While processing SCSI i/o requests in mptsas_process_scsi_io_request(),
> the Megaraid emulator appends new MPTSASRequest object 'req' to
> the 's->pending' queue. In case of an error, this same object gets
> dequeued in mptsas_free_request() only if SCSIRequest object
> 'req->sreq' is initialised. This may lead to a use-after-free issue.
>
> Since s->pending is actually not used, simply remove it from
> MPTSASState.
>
> Cc: qemu-sta...@nongnu.org
> Signed-off-by: Michael Tokarev <m...@tls.msk.ru>
> Reviewed-by: Philippe Mathieu-Daudé <phi...@redhat.com>
> Message-Id: <20210416102243.1293871-1-...@msgid.tls.msk.ru>
> Reported-by: Cheolwoo Myung <cwmy...@snu.ac.kr>
> BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392)
> Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device")
> [PMD: Reworded description, added more tags]
> Signed-off-by: Philippe Mathieu-Daudé <phi...@redhat.com>
> ---
> Supersedes: <20210416102243.1293871-1-...@msgid.tls.msk.ru>
>
> MJT patch:
> https://www.mail-archive.com/qemu-devel@nongnu.org/msg799236.html
>
> Since rc4 is soon, I'm directly respining his patch with my comments
> addressed.
>
> This is not a new regression (present since QEMU v2.6.0) but is a
> CVE...
>
> PJP first patch:
> https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg02660.html
> ---
> hw/scsi/mptsas.h | 1 -
> hw/scsi/mptsas.c | 4 ----
> 2 files changed, 5 deletions(-)
This fails to compile:
../../hw/scsi/mptsas.c: In function ‘mptsas_free_request’:
../../hw/scsi/mptsas.c:254:18: error: unused variable ‘s’
[-Werror=unused-variable]
MPTSASState *s = req->dev;
^
cc1: all warnings being treated as errors
thanks
-- PMM
