[Qemu-commits] [qemu/qemu] 10c49e: mptsas: Remove unused MPTSASState 'pending' field ...

[Paolo Bonzini]

  Branch: refs/heads/staging
  Home:   https://github.com/qemu/qemu
  Commit: 10c49e21e13be726c9a9d1a69f9e55fd652320b6
      
https://github.com/qemu/qemu/commit/10c49e21e13be726c9a9d1a69f9e55fd652320b6
  Author: Michael Tokarev <mjt@tls.msk.ru>
  Date:   2021-04-19 (Mon, 19 Apr 2021)

  Changed paths:
    M hw/scsi/mptsas.c
    M hw/scsi/mptsas.h

  Log Message:
  -----------
  mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)

While processing SCSI i/o requests in mptsas_process_scsi_io_request(),
the Megaraid emulator appends new MPTSASRequest object 'req' to
the 's->pending' queue. In case of an error, this same object gets
dequeued in mptsas_free_request() only if SCSIRequest object
'req->sreq' is initialised. This may lead to a use-after-free issue.

Since s->pending is actually not used, simply remove it from
MPTSASState.

Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Message-id: 20210418053039.811996-1-philmd@redhat.com
Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392)
Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device")
[PMD: Reworded description, added more tags]
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>