scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)
authorMauro Matteo Cascella <mcascell@redhat.com>
Tue, 5 Jul 2022 20:05:43 +0000 (22:05 +0200)
committerPaolo Bonzini <pbonzini@redhat.com>
Wed, 6 Jul 2022 07:31:15 +0000 (09:31 +0200)
commit6c8fa961da5e60f574bb52fd3ad44b1e9e8ad4b8
tree1fa7da9a1dd2ff4a47879164df8331430d0aae70
parent170ed475cd5f78261c56cebf12541ceee4807594
scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)

Set current_req->req to NULL to prevent reusing a free'd buffer in case of
repeated SCSI cancel requests. Thanks to Thomas Huth for suggesting the patch.

Fixes: CVE-2022-0216
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220705200543.2366809-1-mcascell@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
hw/scsi/lsi53c895a.c