Mauro Matteo Cascella 6c8fa961da scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) ...

Set current_req->req to NULL to prevent reusing a free'd buffer in case of
repeated SCSI cancel requests. Thanks to Thomas Huth for suggesting the patch.

Fixes: CVE-2022-0216
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972
Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20220705200543.2366809-1-mcascell@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

2022-07-06 09:31:15 +02:00

..

emulation.c

…

esp-pci.c

…

esp.c

…

Kconfig

…

lsi53c895a.c

scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216)

2022-07-06 09:31:15 +02:00

megasas.c

…

meson.build

…

mfi.h

Fix 'writeable' typos

2022-06-08 19:38:47 +01:00

mpi.h

…

mptconfig.c

…

mptendian.c

…

mptsas.c

…

mptsas.h

…

scsi-bus.c

…

scsi-disk.c

block: get rid of blk->guest_block_size

2022-06-24 17:07:06 +02:00

scsi-generic.c

block: get rid of blk->guest_block_size

2022-06-24 17:07:06 +02:00

spapr_vscsi.c

Trivial: 3 char repeat typos

2022-06-28 11:06:02 +02:00

srp.h

…

trace-events

…

trace.h

…

vhost-scsi-common.c

…

vhost-scsi.c

virtio: add vhost support for virtio devices

2022-05-16 04:38:40 -04:00

vhost-user-scsi.c

hw/vhost-user-scsi|blk: set supports_config flag correctly

2022-06-09 19:32:49 -04:00

viosrp.h

…

virtio-scsi-dataplane.c

…

virtio-scsi.c

…

vmw_pvscsi.c

…

vmw_pvscsi.h

…