Re: [PATCH-for-6.0? v2] mptsas: Remove unused MPTSASState 'pending' field (CVE-2021-3392)

[Peter Maydell]

On Sun, 18 Apr 2021 at 06:30, Philippe Mathieu-Daudé <philmd@redhat.com> wrote:
>
> From: Michael Tokarev <mjt@tls.msk.ru>
>
> While processing SCSI i/o requests in mptsas_process_scsi_io_request(),
> the Megaraid emulator appends new MPTSASRequest object 'req' to
> the 's->pending' queue. In case of an error, this same object gets
> dequeued in mptsas_free_request() only if SCSIRequest object
> 'req->sreq' is initialised. This may lead to a use-after-free issue.
>
> Since s->pending is actually not used, simply remove it from
> MPTSASState.
>
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru>
> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
> BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392)
> Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device")
> [PMD: Reworded description, added more tags]
> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
> ---
> Supersedes: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru>
>
> MJT patch:
> https://www.mail-archive.com/qemu-devel@nongnu.org/msg799236.html
>
> Since rc4 is soon, I'm directly respining his patch with my comments
> addressed.
>
> This is not a new regression (present since QEMU v2.6.0) but is a
> CVE...
>
> PJP first patch:
> https://lists.gnu.org/archive/html/qemu-devel/2021-02/msg02660.html
> ---
>  hw/scsi/mptsas.h | 1 -
>  hw/scsi/mptsas.c | 4 ----
>  2 files changed, 5 deletions(-)

This fails to compile:

../../hw/scsi/mptsas.c: In function ‘mptsas_free_request’:
../../hw/scsi/mptsas.c:254:18: error: unused variable ‘s’
[-Werror=unused-variable]
     MPTSASState *s = req->dev;
                  ^
cc1: all warnings being treated as errors


thanks
-- PMM