1From 8f2c2cb908758192d5ebc00605cbf0989b8a507c Mon Sep 17 00:00:00 2001 2From: Mauro Matteo Cascella <mcascell@redhat.com> 3Date: Mon, 11 Jul 2022 14:33:16 +0200 4Subject: [PATCH 3/3] scsi/lsi53c895a: really fix use-after-free in 5 lsi_do_msgout (CVE-2022-0216) 6 7Set current_req to NULL, not current_req->req, to prevent reusing a free'd 8buffer in case of repeated SCSI cancel requests. Also apply the fix to 9CLEAR QUEUE and BUS DEVICE RESET messages as well, since they also cancel 10the request. 11 12Thanks to Alexander Bulekov for providing a reproducer. 13 14Fixes: CVE-2022-0216 15Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972 16Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> 17Tested-by: Alexander Bulekov <alxndr@bu.edu> 18Message-Id: <20220711123316.421279-1-mcascell@redhat.com> 19Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> 20 21Upstream-Status: Backport [4367a20cc442c56b05611b4224de9a61908f9eac] 22CVE: CVE-2022-0216 23 24Signed-off-by: Sakib Sajal <sakib.sajal@windriver.com> 25--- 26 hw/scsi/lsi53c895a.c | 3 ++- 27 1 file changed, 2 insertions(+), 1 deletion(-) 28 29diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c 30index 8033cf050..fbe3fa3dd 100644 31--- a/hw/scsi/lsi53c895a.c 32+++ b/hw/scsi/lsi53c895a.c 33@@ -1031,7 +1031,7 @@ static void lsi_do_msgout(LSIState *s) 34 trace_lsi_do_msgout_abort(current_tag); 35 if (current_req && current_req->req) { 36 scsi_req_cancel(current_req->req); 37- current_req->req = NULL; 38+ current_req = NULL; 39 } 40 lsi_disconnect(s); 41 break; 42@@ -1057,6 +1057,7 @@ static void lsi_do_msgout(LSIState *s) 43 /* clear the current I/O process */ 44 if (s->current) { 45 scsi_req_cancel(s->current->req); 46+ current_req = NULL; 47 } 48 49 /* As the current implemented devices scsi_disk and scsi_generic 50-- 512.33.0 52 53