[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 049/115] megasas: avoid NULL pointer dereference
From: |
Paolo Bonzini |
Subject: |
[PULL 049/115] megasas: avoid NULL pointer dereference |
Date: |
Thu, 11 Jun 2020 15:43:43 -0400 |
From: Prasad J Pandit <pjp@fedoraproject.org>
While in megasas_handle_frame(), megasas_enqueue_frame() may
set a NULL frame into MegasasCmd object for a given 'frame_addr'
address. Add check to avoid a NULL pointer dereference issue.
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: https://bugs.launchpad.net/qemu/+bug/1878259
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20200513192540.1583887-3-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
hw/scsi/megasas.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 6ce598cd69..b531d88a9b 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -504,7 +504,7 @@ static MegasasCmd *megasas_enqueue_frame(MegasasState *s,
cmd->pa = frame;
/* Map all possible frames */
cmd->frame = pci_dma_map(pcid, frame, &frame_size_p, 0);
- if (frame_size_p != frame_size) {
+ if (!cmd->frame || frame_size_p != frame_size) {
trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
if (cmd->frame) {
megasas_unmap_frame(s, cmd);
--
2.26.2
- [PULL 026/115] hw/i386/vmport: Add device properties, (continued)
- [PULL 026/115] hw/i386/vmport: Add device properties, Paolo Bonzini, 2020/06/11
- [PULL 051/115] target/i386: implement special cases for fxtract, Paolo Bonzini, 2020/06/11
- [PULL 056/115] exec: Let address_space_read/write_cached() propagate MemTxResult, Paolo Bonzini, 2020/06/11
- [PULL 038/115] hw/i386/vmport: Assert vmport initialized before registering commands, Paolo Bonzini, 2020/06/11
- [PULL 042/115] qom/object: simplify type_initialize_interface(), Paolo Bonzini, 2020/06/11
- [PULL 046/115] hax: Dynamic allocate vcpu state structure, Paolo Bonzini, 2020/06/11
- [PULL 053/115] target/i386: fix fscale handling of invalid exponent encodings, Paolo Bonzini, 2020/06/11
- [PULL 052/115] target/i386: fix fscale handling of signaling NaN, Paolo Bonzini, 2020/06/11
- [PULL 043/115] qom/object: pass (Object *) to object_initialize_with_type(), Paolo Bonzini, 2020/06/11
- [PULL 034/115] hw/i386/vmport: Add support for CMD_GET_VCPU_INFO, Paolo Bonzini, 2020/06/11
- [PULL 049/115] megasas: avoid NULL pointer dereference,
Paolo Bonzini <=
- [PULL 061/115] target/i386: fix fxam handling of invalid encodings, Paolo Bonzini, 2020/06/11
- [PULL 062/115] target/i386: fix fbstp handling of negative zero, Paolo Bonzini, 2020/06/11
- [PULL 065/115] hw/i386/vmport: Allow QTest use without crashing, Paolo Bonzini, 2020/06/11
- [PULL 063/115] target/i386: fix fbstp handling of out-of-range values, Paolo Bonzini, 2020/06/11
- [PULL 054/115] target/i386: fix fscale handling of infinite exponents, Paolo Bonzini, 2020/06/11
- [PULL 044/115] qom/container: remove .instance_size initializer from container_info, Paolo Bonzini, 2020/06/11
- [PULL 037/115] hw/i386/vmport: Add support for CMD_GETHZ, Paolo Bonzini, 2020/06/11
- [PULL 045/115] cpus: Fix botched configure_icount() error API violation fix, Paolo Bonzini, 2020/06/11
- [PULL 041/115] qom/object: factor out the initialization of hash table of properties, Paolo Bonzini, 2020/06/11
- [PULL 055/115] target/i386: fix fscale handling of rounding precision, Paolo Bonzini, 2020/06/11