Mauro Matteo Cascella 4367a20cc4 scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216) ... Set current_req to NULL, not current_req->req, to prevent reusing a free'd buffer in case of repeated SCSI cancel requests. Also apply the fix to CLEAR QUEUE and BUS DEVICE RESET messages as well, since they also cancel the request. Thanks to Alexander Bulekov for providing a reproducer. Fixes: CVE-2022-0216 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/972 Signed-off-by: Mauro Matteo Cascella <mcascell@redhat.com> Tested-by: Alexander Bulekov <alxndr@bu.edu> Message-Id: <20220711123316.421279-1-mcascell@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>		2022-07-13 16:58:57 +02:00
..
fuzz	vfio-user: handle PCI BAR accesses	2022-06-15 16:43:42 +01:00
libqos	tests/qtest/libqos: Add generic pci host bridge in arm-virt machine	2022-05-12 12:07:06 +02:00
ac97-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
acpi-utils.c	Remove qemu-common.h include from most units	2022-04-06 14:31:55 +02:00
acpi-utils.h	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
adm1272-test.c	tests/qtest: add tests for ADM1272 device model	2021-07-08 14:41:59 -05:00
ahci-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
am53c974-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
arm-cpu-features.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
aspeed_gpio-test.c	hw: m25p80: allow write_enable latch get/set	2022-05-25 10:31:33 +02:00
aspeed_hace-test.c	Misc cleanups	2022-05-03 09:13:17 -07:00
aspeed_smc-test.c	hw: m25p80: add tests for write protect (WP# and SRWD bit)	2022-06-30 09:21:13 +02:00
bios-tables-test-allowed-diff.h	tests/acpi: virt: update golden masters for VIOT	2022-06-09 19:32:49 -04:00
bios-tables-test.c	hw/cxl: Make the CXL fixed memory window setup a machine parameter.	2022-06-09 19:32:49 -04:00
boot-order-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
boot-sector.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
boot-sector.h	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
boot-serial-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
cdrom-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
cmsdk-apb-dualtimer-test.c	tests: Add a simple test of the CMSDK APB dual timer	2021-01-29 15:54:42 +00:00
cmsdk-apb-timer-test.c	tests: Add a simple test of the CMSDK APB timer	2021-01-29 15:54:42 +00:00
cmsdk-apb-watchdog-test.c	tests/qtest/cmsdk-apb-watchdog-test: Test clock changes	2021-01-29 15:54:44 +00:00
cpu-plug-test.c	Remove qemu-common.h include from most units	2022-04-06 14:31:55 +02:00
cxl-test.c	hw/cxl: Make the CXL fixed memory window setup a machine parameter.	2022-06-09 19:32:49 -04:00
dbus-display-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
dbus-vmstate-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
device-introspect-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
device-plug-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
display-vga-test.c	test: Move qtests to a separate directory	2020-01-12 11:42:41 +01:00
drive_del-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
ds1338-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
e1000-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
e1000e-test.c	tests/qtest/libqos: Skip hotplug tests if pci root bus is not hotpluggable	2022-05-12 12:07:06 +02:00
eepro100-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
emc141x-test.c	sensor: Move hardware sensors from misc to a sensor directory	2021-06-17 07:10:32 -05:00
endianness-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
erst-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
es1370-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
fdc-test.c	tests/qtest/fdc-test: Add a regression test for CVE-2021-3507	2022-05-12 13:03:25 +02:00
fuzz-e1000e-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
fuzz-lsi53c895a-test.c	scsi/lsi53c895a: really fix use-after-free in lsi_do_msgout (CVE-2022-0216)	2022-07-13 16:58:57 +02:00
fuzz-megasas-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
fuzz-sb16-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
fuzz-sdcard-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
fuzz-virtio-scsi-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
fuzz-xlnx-dp-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
fw_cfg-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
hd-geo-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
hexloader-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
i440fx-test.c	tests/x86: Use 'pc' machine type for old hardware tests	2022-02-21 10:13:23 +01:00
i82801b11-test.c	test: Move qtests to a separate directory	2020-01-12 11:42:41 +01:00
ide-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
intel-hda-test.c	tests/qtest/intel-hda-test: Add reproducer for issue #542	2022-03-21 10:25:21 +01:00
ioh3420-test.c	test: Move qtests to a separate directory	2020-01-12 11:42:41 +01:00
ipmi-bt-test.c	Remove qemu-common.h include from most units	2022-04-06 14:31:55 +02:00
ipmi-kcs-test.c	tests: Avoid side effects inside g_assert() arguments	2021-05-14 12:28:01 +02:00
ipoctal232-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
isl_pmbus_vr-test.c	hw/sensor: add Renesas raa228000 device	2022-03-08 18:46:48 +01:00
ivshmem-test.c	tests: replace pipe() with g_unix_open_pipe(CLOEXEC)	2022-05-03 15:46:08 +04:00
libqmp.c	tests: make libqmp buildable for win32	2022-05-28 11:42:56 +02:00
libqmp.h	tests: make libqmp buildable for win32	2022-05-28 11:42:56 +02:00
libqtest-single.h	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
libqtest.c	hw: m25p80: allow write_enable latch get/set	2022-05-25 10:31:33 +02:00
libqtest.h	hw: m25p80: allow write_enable latch get/set	2022-05-25 10:31:33 +02:00
lpc-ich9-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
lsm303dlhc-mag-test.c	hw/sensor: Add lsm303dlhc magnetometer device	2022-02-08 10:56:29 +00:00
m48t59-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
machine-none-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
max34451-test.c	tests/qtest: add tests for MAX34451 device model	2021-07-08 14:42:00 -05:00
megasas-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
meson.build	virtio,pc,pci: fixes,cleanups,features	2022-05-16 16:31:01 -07:00
microbit-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
migration-helpers.c	tests: wait max 120 seconds for migration test status changes	2022-07-05 09:33:58 +02:00
migration-helpers.h	tests: ensure migration status isn't reported as failed	2022-05-16 11:46:04 +01:00
migration-test.c	tests: use consistent bandwidth/downtime limits in migration tests	2022-07-05 09:33:58 +02:00
modules-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
ne2000-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
npcm7xx_adc-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
npcm7xx_emc-test.c	Remove qemu-common.h include from most units	2022-04-06 14:31:55 +02:00
npcm7xx_gpio-test.c	hw/gpio: Add GPIO model for Nuvoton NPCM7xx	2020-10-27 11:10:32 +00:00
npcm7xx_pwm-test.c	qtest/npcm7xx_pwm-test: Fix memory leak in mft_qom_set	2022-06-03 08:03:28 +02:00
npcm7xx_rng-test.c	include: move C/util-related declarations to cutils.h	2022-04-06 14:31:43 +02:00
npcm7xx_sdhci-test.c	tests/qtest: Reduce npcm7xx_sdhci test image size	2022-06-10 14:32:35 +01:00
npcm7xx_smbus-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
npcm7xx_timer-test.c	tests/qtest: variable defined by g_autofree need to be initialized	2020-11-20 13:34:22 +01:00
npcm7xx_watchdog_timer-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
numa-test.c	qtest/numa-test: Correct CPU and NUMA association in aarch64_numa_cpu()	2022-05-09 11:47:55 +01:00
nvme-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
pca9552-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
pci-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
pcnet-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
pflash-cfi02-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
pnv-xscom-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
prom-env-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
pvpanic-pci-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
pvpanic-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
pxe-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
q35-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
qmp-cmd-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
qmp-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
qom-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
qos-test.c	tests/qtest/qos-test: dump QEMU command if verbose	2021-02-16 17:15:39 +01:00
rtas-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
rtc-test.c	tests/qtest/rtc-test: Remove pointless NULL check	2021-05-14 12:28:01 +02:00
rtl8139-test.c	Remove qemu-common.h include from most units	2022-04-06 14:31:55 +02:00
sdhci-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
spapr-phb-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
sse-timer-test.c	tests/qtest/sse-timer-test: Test counter scaling changes	2021-03-08 17:20:03 +00:00
tco-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
test-arm-mptimer.c	test: Move qtests to a separate directory	2020-01-12 11:42:41 +01:00
test-filter-mirror.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
test-filter-redirector.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
test-hmp.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
test-netfilter.c	tests/qtest: Make the filter tests independent from a specific NIC	2021-12-22 08:13:05 +01:00
test-x86-cpuid-compat.c	Remove qemu-common.h include from most units	2022-04-06 14:31:55 +02:00
tmp105-test.c	sensor: Move hardware sensors from misc to a sensor directory	2021-06-17 07:10:32 -05:00
tpm-crb-swtpm-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
tpm-crb-test.c	tests: Add tpm_version field to TPMTestState and fill it	2021-08-31 17:33:11 -04:00
tpm-emu.c	tests: Use QMP to check whether a TPM device model is available	2021-08-31 17:33:12 -04:00
tpm-emu.h	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
tpm-tests.c	tests/qtest/tpm-tests: Remove unnecessary NULL checks	2021-06-03 16:43:27 +01:00
tpm-tests.h	test: tpm: pass optional machine options to swtpm test functions	2020-03-05 12:18:33 -05:00
tpm-tis-device-swtpm-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
tpm-tis-device-test.c	tests: Add tpm_version field to TPMTestState and fill it	2021-08-31 17:33:11 -04:00
tpm-tis-swtpm-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
tpm-tis-test.c	tests: Add tpm_version field to TPMTestState and fill it	2021-08-31 17:33:11 -04:00
tpm-tis-util.c	tests: Rename TestState to TPMTestState	2021-08-31 17:33:10 -04:00
tpm-tis-util.h	test: tpm-tis: Get prepared to share tests between ISA and sysbus devices	2020-03-05 12:18:39 -05:00
tpm-util.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
tpm-util.h	test: tpm-tis: Get prepared to share tests between ISA and sysbus devices	2020-03-05 12:18:39 -05:00
tulip-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
usb-hcd-ehci-test.c	libqos: usb-hcd-ehci: use 32-bit write for config register	2020-06-26 06:45:29 -04:00
usb-hcd-ohci-test.c	test: Move qtests to a separate directory	2020-01-12 11:42:41 +01:00
usb-hcd-uhci-test.c	test: Move qtests to a separate directory	2020-01-12 11:42:41 +01:00
usb-hcd-xhci-test.c	test: Move qtests to a separate directory	2020-01-12 11:42:41 +01:00
vhost-user-blk-test.c	tests/qtest/libqos: Skip hotplug tests if pci root bus is not hotpluggable	2022-05-12 12:07:06 +02:00
vhost-user-test.c	tests/qtest: use g_autofree for test_server_create_chr	2022-06-03 08:03:28 +02:00
virtio-9p-test.c	tests/9pfs: check fid being unaffected in fs_walk_2nd_nonexistent	2022-06-16 12:44:52 +02:00
virtio-blk-test.c	tests/qtest/libqos: Skip hotplug tests if pci root bus is not hotpluggable	2022-05-12 12:07:06 +02:00
virtio-ccw-test.c	test: Move qtests to a separate directory	2020-01-12 11:42:41 +01:00
virtio-iommu-test.c	tests/qtest/virtio-iommu-test: Check bypass config	2022-03-06 05:08:23 -05:00
virtio-net-failover.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
virtio-net-test.c	tests/qtest/libqos: Skip hotplug tests if pci root bus is not hotpluggable	2022-05-12 12:07:06 +02:00
virtio-rng-test.c	tests/qtest/libqos: Skip hotplug tests if pci root bus is not hotpluggable	2022-05-12 12:07:06 +02:00
virtio-scsi-test.c	tests/qtest/virtio-scsi-test: add unmap large LBA with 4k blocks test	2021-06-04 13:47:08 +02:00
virtio-serial-test.c	test: Move qtests to a separate directory	2020-01-12 11:42:41 +01:00
virtio-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
vmgenid-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
vmxnet3-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
wdt_ib700-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00
xlnx-can-test.c	tests: move libqtest.h back under qtest/	2022-05-03 15:16:51 +04:00