File hw-scsi-megasas-check-for-NULL-frame-in-.patch of Package qemu.30221

Overview Repositories Revisions Requests Users Attributes Meta

File hw-scsi-megasas-check-for-NULL-frame-in-.patch of Package qemu.30221

From: Mauro Matteo Cascella <mcascell@redhat.com>
Date: Thu, 24 Dec 2020 18:54:41 +0100
Subject: hw/scsi/megasas: check for NULL frame in megasas_command_cancelled()

Git-commit: 00000000000000000000000000000000000000000000
References: bsc#1180432, CVE-2020-35503

Ensure that 'cmd->frame' is not NULL before accessing the 'header' field.
This check prevents a potential NULL pointer dereference issue.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1910346
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Acked-By: Jose R Ziviani <jose.ziviani@suse.com>
---
 hw/scsi/megasas.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 1bdd25e55684c7b6026381a97f3e..376ac1f0c238e7bf86a294fa10e1 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -1884,7 +1884,7 @@ static void megasas_command_cancelled(SCSIRequest *req)
 {
     MegasasCmd *cmd = req->hba_private;
 
-    if (!cmd) {
+    if (!cmd || !cmd->frame) {
         return;
     }
     cmd->frame->header.cmd_status = MFI_STAT_SCSI_IO_FAILED;

Places

File hw-scsi-megasas-check-for-NULL-frame-in-.patch of Package qemu.30221

Places