[Qemu-devel] [PATCH 0/1] (for-2.5) Don't allow a guest to crash QEMU

[Qemu-devel] [PATCH 0/1] (for-2.5) Don't allow a guest to crash QEMU

[Eugene (jno) Dvurechenski]

I've found the case where erratic guest was able to crash QEMU.
This patch prevents dereferencing of a NULL pointer (empty 'd'
in the assertion, no valid LUN was specified).

Eugene (jno) Dvurechenski (1):
  virtio-scsi: don't crash without a valid device

 hw/scsi/virtio-scsi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

-- 
2.3.9

[Qemu-devel] [PATCH v1 1/1] (for-2.5) virtio-scsi: don't crash without a valid device

[Eugene (jno) Dvurechenski]

Make sure that we actually have a device when checking the aio
context. Otherwise guests could trigger QEMU crashes.

Signed-off-by: "Eugene (jno) Dvurechenski" <jno@linux.vnet.ibm.com>
Reviewed-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
---
 hw/scsi/virtio-scsi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index 7655401..3a4f520 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -250,7 +250,7 @@ static int virtio_scsi_do_tmf(VirtIOSCSI *s, VirtIOSCSIReq *req)
     int target;
     int ret = 0;
 
-    if (s->dataplane_started) {
+    if (s->dataplane_started && d) {
         assert(blk_get_aio_context(d->conf.blk) == s->ctx);
     }
     /* Here VIRTIO_SCSI_S_OK means "FUNCTION COMPLETE".  */
-- 
2.3.9