diff options
| author | Prasad J Pandit | 2020-05-13 21:25:39 +0200 |
|---|---|---|
| committer | Paolo Bonzini | 2020-06-10 18:10:12 +0200 |
| commit | fd6918556736ecce8b10acd581ba134ffb62d9f9 (patch) | |
| tree | 43ab7674d72154e55c9b2dfa85024d1ddb9b727b /hw/scsi/megasas.c | |
| parent | megasas: use unsigned type for reply_queue_head and check index (diff) | |
| download | qemu-fd6918556736ecce8b10acd581ba134ffb62d9f9.tar.gz qemu-fd6918556736ecce8b10acd581ba134ffb62d9f9.tar.xz qemu-fd6918556736ecce8b10acd581ba134ffb62d9f9.zip | |
megasas: avoid NULL pointer dereference
While in megasas_handle_frame(), megasas_enqueue_frame() may
set a NULL frame into MegasasCmd object for a given 'frame_addr'
address. Add check to avoid a NULL pointer dereference issue.
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: https://bugs.launchpad.net/qemu/+bug/1878259
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20200513192540.1583887-3-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Diffstat (limited to 'hw/scsi/megasas.c')
| -rw-r--r-- | hw/scsi/megasas.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c index 6ce598cd69..b531d88a9b 100644 --- a/hw/scsi/megasas.c +++ b/hw/scsi/megasas.c @@ -504,7 +504,7 @@ static MegasasCmd *megasas_enqueue_frame(MegasasState *s, cmd->pa = frame; /* Map all possible frames */ cmd->frame = pci_dma_map(pcid, frame, &frame_size_p, 0); - if (frame_size_p != frame_size) { + if (!cmd->frame || frame_size_p != frame_size) { trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame); if (cmd->frame) { megasas_unmap_frame(s, cmd); |