Hi Prasad,
On 8/8/19 8:56 AM, P J P wrote:
> From: Prasad J Pandit <p...@fedoraproject.org>
>
> AHCI emulator while committing DMA buffer in ahci_commit_buf()
> may do a NULL dereference if the command header 'ad->cur_cmd'
> is null. Add check to avoid it.
>
> Reported-by: Bugs SysSec <bugs-sys...@rub.de>
> Signed-off-by: Prasad J Pandit <p...@fedoraproject.org>
> ---
> hw/ide/ahci.c | 6 ++++--
> 1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
> index 00ba422a48..9fff94075b 100644
> --- a/hw/ide/ahci.c
> +++ b/hw/ide/ahci.c
> @@ -1458,8 +1458,10 @@ static void ahci_commit_buf(IDEDMA *dma, uint32_t
> tx_bytes)
> {
> AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
>
> - tx_bytes += le32_to_cpu(ad->cur_cmd->status);
> - ad->cur_cmd->status = cpu_to_le32(tx_bytes);
> + if (ad->cur_cmd) {
My 2 cents, John will correct me:
This is not a valid condition, so an assert() might be more appropriate
here.
Why is dma_buf_commit() being called with a null command? This check
should go elsewhere to avoid the call.
> + tx_bytes += le32_to_cpu(ad->cur_cmd->status);
> + ad->cur_cmd->status = cpu_to_le32(tx_bytes);
> + }
> }
>
> static int ahci_dma_rw_buf(IDEDMA *dma, int is_write)
>
