3791642c8d
While processing SCSI i/o requests in mptsas_process_scsi_io_request(), the Megaraid emulator appends new MPTSASRequest object 'req' to the 's->pending' queue. In case of an error, this same object gets dequeued in mptsas_free_request() only if SCSIRequest object 'req->sreq' is initialised. This may lead to a use-after-free issue. Since s->pending is actually not used, simply remove it from MPTSASState. Cc: qemu-stable@nongnu.org Signed-off-by: Michael Tokarev <mjt@tls.msk.ru> Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com> Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> Message-id: 20210419134247.1467982-1-f4bug@amsat.org Message-Id: <20210416102243.1293871-1-mjt@msgid.tls.msk.ru> Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr> BugLink: https://bugs.launchpad.net/qemu/+bug/1914236 (CVE-2021-3392) Fixes: e351b826112 ("hw: Add support for LSI SAS1068 (mptsas) device") [PMD: Reworded description, added more tags] Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
106 lines
3.0 KiB
C
106 lines
3.0 KiB
C
#ifndef MPTSAS_H
|
|
#define MPTSAS_H
|
|
|
|
#include "mpi.h"
|
|
#include "qom/object.h"
|
|
|
|
#define MPTSAS_NUM_PORTS 8
|
|
#define MPTSAS_MAX_FRAMES 2048 /* Firmware limit at 65535 */
|
|
|
|
#define MPTSAS_REQUEST_QUEUE_DEPTH 128
|
|
#define MPTSAS_REPLY_QUEUE_DEPTH 128
|
|
|
|
#define MPTSAS_MAXIMUM_CHAIN_DEPTH 0x22
|
|
|
|
typedef struct MPTSASRequest MPTSASRequest;
|
|
|
|
#define TYPE_MPTSAS1068 "mptsas1068"
|
|
typedef struct MPTSASState MPTSASState;
|
|
DECLARE_INSTANCE_CHECKER(MPTSASState, MPT_SAS,
|
|
TYPE_MPTSAS1068)
|
|
|
|
enum {
|
|
DOORBELL_NONE,
|
|
DOORBELL_WRITE,
|
|
DOORBELL_READ
|
|
};
|
|
|
|
struct MPTSASState {
|
|
PCIDevice dev;
|
|
MemoryRegion mmio_io;
|
|
MemoryRegion port_io;
|
|
MemoryRegion diag_io;
|
|
QEMUBH *request_bh;
|
|
|
|
/* properties */
|
|
OnOffAuto msi;
|
|
uint64_t sas_addr;
|
|
|
|
bool msi_in_use;
|
|
|
|
/* Doorbell register */
|
|
uint32_t state;
|
|
uint8_t who_init;
|
|
uint8_t doorbell_state;
|
|
|
|
/* Buffer for requests that are sent through the doorbell register. */
|
|
uint32_t doorbell_msg[256];
|
|
int doorbell_idx;
|
|
int doorbell_cnt;
|
|
|
|
uint16_t doorbell_reply[256];
|
|
int doorbell_reply_idx;
|
|
int doorbell_reply_size;
|
|
|
|
/* Other registers */
|
|
uint8_t diagnostic_idx;
|
|
uint32_t diagnostic;
|
|
uint32_t intr_mask;
|
|
uint32_t intr_status;
|
|
|
|
/* Request queues */
|
|
uint32_t request_post[MPTSAS_REQUEST_QUEUE_DEPTH + 1];
|
|
uint16_t request_post_head;
|
|
uint16_t request_post_tail;
|
|
|
|
uint32_t reply_post[MPTSAS_REPLY_QUEUE_DEPTH + 1];
|
|
uint16_t reply_post_head;
|
|
uint16_t reply_post_tail;
|
|
|
|
uint32_t reply_free[MPTSAS_REPLY_QUEUE_DEPTH + 1];
|
|
uint16_t reply_free_head;
|
|
uint16_t reply_free_tail;
|
|
|
|
/* IOC Facts */
|
|
hwaddr host_mfa_high_addr;
|
|
hwaddr sense_buffer_high_addr;
|
|
uint16_t max_devices;
|
|
uint16_t max_buses;
|
|
uint16_t reply_frame_size;
|
|
|
|
SCSIBus bus;
|
|
};
|
|
|
|
void mptsas_fix_scsi_io_endianness(MPIMsgSCSIIORequest *req);
|
|
void mptsas_fix_scsi_io_reply_endianness(MPIMsgSCSIIOReply *reply);
|
|
void mptsas_fix_scsi_task_mgmt_endianness(MPIMsgSCSITaskMgmt *req);
|
|
void mptsas_fix_scsi_task_mgmt_reply_endianness(MPIMsgSCSITaskMgmtReply *reply);
|
|
void mptsas_fix_ioc_init_endianness(MPIMsgIOCInit *req);
|
|
void mptsas_fix_ioc_init_reply_endianness(MPIMsgIOCInitReply *reply);
|
|
void mptsas_fix_ioc_facts_endianness(MPIMsgIOCFacts *req);
|
|
void mptsas_fix_ioc_facts_reply_endianness(MPIMsgIOCFactsReply *reply);
|
|
void mptsas_fix_config_endianness(MPIMsgConfig *req);
|
|
void mptsas_fix_config_reply_endianness(MPIMsgConfigReply *reply);
|
|
void mptsas_fix_port_facts_endianness(MPIMsgPortFacts *req);
|
|
void mptsas_fix_port_facts_reply_endianness(MPIMsgPortFactsReply *reply);
|
|
void mptsas_fix_port_enable_endianness(MPIMsgPortEnable *req);
|
|
void mptsas_fix_port_enable_reply_endianness(MPIMsgPortEnableReply *reply);
|
|
void mptsas_fix_event_notification_endianness(MPIMsgEventNotify *req);
|
|
void mptsas_fix_event_notification_reply_endianness(MPIMsgEventNotifyReply *reply);
|
|
|
|
void mptsas_reply(MPTSASState *s, MPIDefaultReply *reply);
|
|
|
|
void mptsas_process_config(MPTSASState *s, MPIMsgConfig *req);
|
|
|
|
#endif /* MPTSAS_H */
|