From nobody Sun Feb 8 21:32:23 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1657542953; cv=none; d=zohomail.com; s=zohoarc; b=fM5qqBtoUY3yNQ7qf5p5rh9nvz0O95t68jBLRI6RN9I3eXNSMNRA6Yt0/zcmO+AkX7ju9VO4RX22cQe5ir2xEr0blZKO2MSa7a5q2SJ/OrW8+2bpNtAuIXEuLwzmOlqPr/A9Mj8YVccHFAmGy3KDT9S05KmtMSoBQlRwpFVE0w8= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1657542953; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=bFJ2IIkBCyxBG1qvoFS4GvNefMXeQktvcarxWRfXOVE=; b=NTNBYy5HFAmsQtHI/PHId3E2mbNoomASwTxJsbG4o4JubBbkso9U1RBWOuwWwAufsEUHHWRc+2QIahHqMOej31X0lM5UMP5/H9Yvks4mIXZyWgxa5EZPy683trWbk2kbuP+k9qLGhFMGXlTo6lgBYvzPyxdvqv3zSvckaB+l5ok= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1657542953378484.0855263145446; Mon, 11 Jul 2022 05:35:53 -0700 (PDT) Received: from localhost ([::1]:57010 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1oAsdj-00042U-Kj for importer@patchew.org; Mon, 11 Jul 2022 08:35:51 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:48056) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oAsbW-0002FV-SM for qemu-devel@nongnu.org; Mon, 11 Jul 2022 08:33:34 -0400 Received: from us-smtp-delivery-124.mimecast.com ([170.10.129.124]:40320) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1oAsbT-0008Iy-9B for qemu-devel@nongnu.org; Mon, 11 Jul 2022 08:33:32 -0400 Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-673-PftZKj6hMKSSxljTBoVwiA-1; Mon, 11 Jul 2022 08:33:29 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id CD1771044560; Mon, 11 Jul 2022 12:33:28 +0000 (UTC) Received: from f35-work.redhat.com (unknown [10.39.194.52]) by smtp.corp.redhat.com (Postfix) with ESMTPS id D0D5B2026D64; Mon, 11 Jul 2022 12:33:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1657542810; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=bFJ2IIkBCyxBG1qvoFS4GvNefMXeQktvcarxWRfXOVE=; b=Wq8oXh9xnAr13yMXhANgNQlxESLTfnVWEN2DetrhC9URrtPendcXK11NDT1k9rzRFad6T7 fvvqZikHtm43y2Bcn8UUc1JUeTEi4/BJq/AeCx6NdhTgSAu6atVgifa7SPXmlg7X0M/mMl pKhO4Grgsn4iv5c2m9gtEYaoZxaj6Fo= X-MC-Unique: PftZKj6hMKSSxljTBoVwiA-1 From: Mauro Matteo Cascella To: qemu-devel@nongnu.org Cc: mcascell@redhat.com, pbonzini@redhat.com, fam@euphon.net, thuth@redhat.com, alxndr@bu.edu Subject: [PATCH v2] scsi/lsi53c895a: fix use-after-free in lsi_do_msgout (CVE-2022-0216) Date: Mon, 11 Jul 2022 14:33:16 +0200 Message-Id: <20220711123316.421279-1-mcascell@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.78 on 10.11.54.4 Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.129.124; envelope-from=mcascell@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -28 X-Spam_score: -2.9 X-Spam_bar: -- X-Spam_report: (-2.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.082, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: pass (identity @redhat.com) X-ZM-MESSAGEID: 1657542954583100001 Content-Type: text/plain; charset="utf-8" Set current_req to NULL to prevent reusing a free'd buffer in case of repea= ted SCSI cancel requests. Thanks to Thomas Huth for suggesting the first versio= n of the patch and Alexander Bulekov for providing a reproducer. Fixes: CVE-2022-0216 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972 Signed-off-by: Mauro Matteo Cascella Tested-by: Alexander Bulekov --- v2: - handle CLEAR QUEUE and BUS DEVICE RESET messages - new qtest: test_lsi_do_msgout_cancel_req hw/scsi/lsi53c895a.c | 2 + tests/qtest/fuzz-lsi53c895a-test.c | 71 ++++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+) diff --git a/hw/scsi/lsi53c895a.c b/hw/scsi/lsi53c895a.c index c8773f73f7..6934040c59 100644 --- a/hw/scsi/lsi53c895a.c +++ b/hw/scsi/lsi53c895a.c @@ -1030,6 +1030,7 @@ static void lsi_do_msgout(LSIState *s) trace_lsi_do_msgout_abort(current_tag); if (current_req) { scsi_req_cancel(current_req->req); + current_req =3D NULL; } lsi_disconnect(s); break; @@ -1055,6 +1056,7 @@ static void lsi_do_msgout(LSIState *s) /* clear the current I/O process */ if (s->current) { scsi_req_cancel(s->current->req); + current_req =3D NULL; } =20 /* As the current implemented devices scsi_disk and scsi_gener= ic diff --git a/tests/qtest/fuzz-lsi53c895a-test.c b/tests/qtest/fuzz-lsi53c89= 5a-test.c index 2e8e67859e..6872c70d3a 100644 --- a/tests/qtest/fuzz-lsi53c895a-test.c +++ b/tests/qtest/fuzz-lsi53c895a-test.c @@ -8,6 +8,74 @@ #include "qemu/osdep.h" #include "libqtest.h" =20 +/* + * This used to trigger a UAF in lsi_do_msgout() + * https://gitlab.com/qemu-project/qemu/-/issues/972 + */ +static void test_lsi_do_msgout_cancel_req(void) +{ + QTestState *s; + + s =3D qtest_init("-M q35 -m 4G -display none -nodefaults " + "-device lsi53c895a,id=3Dscsi " + "-device scsi-hd,drive=3Ddisk0 " + "-drive file=3Dnull-co://,id=3Ddisk0,if=3Dnone,format= =3Draw"); + + qtest_outl(s, 0xcf8, 0x80000810); + qtest_outl(s, 0xcf8, 0xc000); + qtest_outl(s, 0xcf8, 0x80000810); + qtest_outw(s, 0xcfc, 0x7); + qtest_outl(s, 0xcf8, 0x80000810); + qtest_outl(s, 0xcfc, 0xc000); + qtest_outl(s, 0xcf8, 0x80000804); + qtest_outw(s, 0xcfc, 0x05); + qtest_writeb(s, 0x69736c10, 0x08); + qtest_writeb(s, 0x69736c13, 0x58); + qtest_writeb(s, 0x69736c1a, 0x01); + qtest_writeb(s, 0x69736c1b, 0x06); + qtest_writeb(s, 0x69736c22, 0x01); + qtest_writeb(s, 0x69736c23, 0x07); + qtest_writeb(s, 0x69736c2b, 0x02); + qtest_writeb(s, 0x69736c48, 0x08); + qtest_writeb(s, 0x69736c4b, 0x58); + qtest_writeb(s, 0x69736c52, 0x04); + qtest_writeb(s, 0x69736c53, 0x06); + qtest_writeb(s, 0x69736c5b, 0x02); + qtest_outl(s, 0xc02d, 0x697300); + qtest_writeb(s, 0x5a554662, 0x01); + qtest_writeb(s, 0x5a554663, 0x07); + qtest_writeb(s, 0x5a55466a, 0x10); + qtest_writeb(s, 0x5a55466b, 0x22); + qtest_writeb(s, 0x5a55466c, 0x5a); + qtest_writeb(s, 0x5a55466d, 0x5a); + qtest_writeb(s, 0x5a55466e, 0x34); + qtest_writeb(s, 0x5a55466f, 0x5a); + qtest_writeb(s, 0x5a345a5a, 0x77); + qtest_writeb(s, 0x5a345a5b, 0x55); + qtest_writeb(s, 0x5a345a5c, 0x51); + qtest_writeb(s, 0x5a345a5d, 0x27); + qtest_writeb(s, 0x27515577, 0x41); + qtest_outl(s, 0xc02d, 0x5a5500); + qtest_writeb(s, 0x364001d0, 0x08); + qtest_writeb(s, 0x364001d3, 0x58); + qtest_writeb(s, 0x364001da, 0x01); + qtest_writeb(s, 0x364001db, 0x26); + qtest_writeb(s, 0x364001dc, 0x0d); + qtest_writeb(s, 0x364001dd, 0xae); + qtest_writeb(s, 0x364001de, 0x41); + qtest_writeb(s, 0x364001df, 0x5a); + qtest_writeb(s, 0x5a41ae0d, 0xf8); + qtest_writeb(s, 0x5a41ae0e, 0x36); + qtest_writeb(s, 0x5a41ae0f, 0xd7); + qtest_writeb(s, 0x5a41ae10, 0x36); + qtest_writeb(s, 0x36d736f8, 0x0c); + qtest_writeb(s, 0x36d736f9, 0x80); + qtest_writeb(s, 0x36d736fa, 0x0d); + qtest_outl(s, 0xc02d, 0x364000); + + qtest_quit(s); +} + /* * This used to trigger the assert in lsi_do_dma() * https://bugs.launchpad.net/qemu/+bug/697510 @@ -44,5 +112,8 @@ int main(int argc, char **argv) qtest_add_func("fuzz/lsi53c895a/lsi_do_dma_empty_queue", test_lsi_do_dma_empty_queue); =20 + qtest_add_func("fuzz/lsi53c895a/lsi_do_msgout_cancel_req", + test_lsi_do_msgout_cancel_req); + return g_test_run(); } --=20 2.35.3