On 4/16/21 1:33 PM, Philippe Mathieu-Daudé wrote: > Cc'ing maintainers. > > On 4/16/21 1:27 PM, Philippe Mathieu-Daudé wrote: >> On 4/16/21 12:22 PM, Michael Tokarev wrote: >>> During previous attempt to fix CVE-2021-3392 it was discovered >>> that MPTSASState.pending is actually not used. So instead of >>> fixing the prob, just remove the offending code entirely >> >> What problem?
Digging a bit I found: https://bugs.launchpad.net/qemu/+bug/1914236 and Paolo's comment: https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg02660.html So your patch now makes sense, but please: 1/ Reword including Prasad description: """ While processing SCSI i/o requests in mptsas_process_scsi_io_request(), the Megaraid emulator appends new MPTSASRequest object 'req' to the 's->pending' queue. In case of an error, this same object gets dequeued in mptsas_free_request() only if SCSIRequest object 'req->sreq' is initialised. This may lead to a use-after-free issue. Since MPTSASState.pending is actually not used, simply remove it. """ 2/ Add: BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392) Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device") With it: Reviewed-by: Philippe Mathieu-Daudé <[email protected]> >>> Signed-off-by: Michael Tokarev <[email protected]> >>> Cc: Prasad J Pandit <[email protected]> >>> Cc: [email protected] >>> --- >>> hw/scsi/mptsas.c | 4 ---- >>> hw/scsi/mptsas.h | 1 - >>> 2 files changed, 5 deletions(-) >>> >>> diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c >>> index 7416e78706..5abbc742aa 100644 >>> --- a/hw/scsi/mptsas.c >>> +++ b/hw/scsi/mptsas.c >>> @@ -257,7 +257,6 @@ static void mptsas_free_request(MPTSASRequest *req) >>> req->sreq->hba_private = NULL; >>> scsi_req_unref(req->sreq); >>> req->sreq = NULL; >>> - QTAILQ_REMOVE(&s->pending, req, next); >>> } >>> qemu_sglist_destroy(&req->qsg); >>> g_free(req); >>> @@ -303,7 +302,6 @@ static int mptsas_process_scsi_io_request(MPTSASState >>> *s, >>> } >>> >>> req = g_new0(MPTSASRequest, 1); >>> - QTAILQ_INSERT_TAIL(&s->pending, req, next); >>> req->scsi_io = *scsi_io; >>> req->dev = s; >>> >>> @@ -1319,8 +1317,6 @@ static void mptsas_scsi_realize(PCIDevice *dev, Error >>> **errp) >>> >>> s->request_bh = qemu_bh_new(mptsas_fetch_requests, s); >>> >>> - QTAILQ_INIT(&s->pending); >>> - >>> scsi_bus_new(&s->bus, sizeof(s->bus), &dev->qdev, &mptsas_scsi_info, >>> NULL); >>> } >>> >>> diff --git a/hw/scsi/mptsas.h b/hw/scsi/mptsas.h >>> index b85ac1a5fc..c046497db7 100644 >>> --- a/hw/scsi/mptsas.h >>> +++ b/hw/scsi/mptsas.h >>> @@ -79,7 +79,6 @@ struct MPTSASState { >>> uint16_t reply_frame_size; >>> >>> SCSIBus bus; >>> - QTAILQ_HEAD(, MPTSASRequest) pending; >>> }; >>> >>> void mptsas_fix_scsi_io_endianness(MPIMsgSCSIIORequest *req); >>> >> >
