Hi Mauro, On Fri, Sep 2, 2022 at 6:44 PM Mauro Matteo Cascella <mcasc...@redhat.com> wrote: > > Hi Bin, > > On Fri, Sep 2, 2022 at 3:56 AM Bin Meng <bmeng...@gmail.com> wrote: > > > > Hi, > > > > On Wed, Jul 13, 2022 at 8:45 PM Paolo Bonzini <pbonz...@redhat.com> wrote: > > > > > > From: Mauro Matteo Cascella <mcasc...@redhat.com> > > > > > > Set current_req to NULL, not current_req->req, to prevent reusing a free'd > > > buffer in case of repeated SCSI cancel requests. Also apply the fix to > > > CLEAR QUEUE and BUS DEVICE RESET messages as well, since they also cancel > > > the request. > > > > > > Thanks to Alexander Bulekov for providing a reproducer. > > > > > > Fixes: CVE-2022-0216 > > > Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972 > > > Signed-off-by: Mauro Matteo Cascella <mcasc...@redhat.com> > > > Tested-by: Alexander Bulekov <alx...@bu.edu> > > > Message-Id: <20220711123316.421279-1-mcasc...@redhat.com> > > > Signed-off-by: Paolo Bonzini <pbonz...@redhat.com> > > > --- > > > Adjust the patch from v1 to v2 since the changes crossed > > > with the pull request. > > > > > > hw/scsi/lsi53c895a.c | 3 +- > > > tests/qtest/fuzz-lsi53c895a-test.c | 71 ++++++++++++++++++++++++++++++ > > > 2 files changed, 73 insertions(+), 1 deletion(-) > > > > > > diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c > > > index 99ea42d49b..ad5f5e5f39 100644 > > > --- a/hw/scsi/lsi53c895a.c > > > +++ b/hw/scsi/lsi53c895a.c > > > @@ -1030,7 +1030,7 @@ static void lsi_do_msgout(LSIState *s) > > > trace_lsi_do_msgout_abort(current_tag); > > > if (current_req && current_req->req) { > > > scsi_req_cancel(current_req->req); > > > - current_req->req = NULL; > > > + current_req = NULL; > > > } > > > lsi_disconnect(s); > > > break; > > > @@ -1056,6 +1056,7 @@ static void lsi_do_msgout(LSIState *s) > > > /* clear the current I/O process */ > > > if (s->current) { > > > scsi_req_cancel(s->current->req); > > > + current_req = NULL; > > > } > > > > > > /* As the current implemented devices scsi_disk and > > > scsi_generic > > > diff --git a/tests/qtest/fuzz-lsi53c895a-test.c > > > b/tests/qtest/fuzz-lsi53c895a-test.c > > > index 2e8e67859e..6872c70d3a 100644 > > > --- a/tests/qtest/fuzz-lsi53c895a-test.c > > > +++ b/tests/qtest/fuzz-lsi53c895a-test.c > > > @@ -8,6 +8,74 @@ > > > #include "qemu/osdep.h" > > > #include "libqtest.h" > > > > > > +/* > > > + * This used to trigger a UAF in lsi_do_msgout() > > > + * https://gitlab.com/qemu-project/qemu/-/issues/972 > > > + */ > > > +static void test_lsi_do_msgout_cancel_req(void) > > > +{ > > > + QTestState *s; > > > + > > > + s = qtest_init("-M q35 -m 4G -display none -nodefaults " > > > > This test does not run on machines with small size memory. Is 4G a > > must have for this test? > > 4G comes from [1], I don't think it's a must have. Would 2G be okay?
2G is much better. My machine has 8G memory and 4G fails sometimes. > For some reason ASAN does not trigger the UAF when I run the test > locally with less than 2G (1.7G to be precise). I didn't really > investigate why that is the case. > > [1] https://gitlab.com/qemu-project/qemu/-/issues/972#note_1019851430. > Regards, Bin