42 lines
1.2 KiB
Diff
42 lines
1.2 KiB
Diff
|
From 9169beed83ea77059a7240aae5621dcfb3178cba Mon Sep 17 00:00:00 2001
|
||
|
|
From: Prasad J Pandit <address@hidden>
|
||
|
|
Date: Mon, 21 Jun 2021 09:22:35 +0800
|
||
|
|
Subject: [PATCH] ide: ahci: add check to avoid null dereference
|
||
|
|
(CVE-2019-12067)
|
||
|
|
|
||
|
|
Fix CVE-2019-12067
|
||
|
|
|
||
|
|
AHCI emulator while committing DMA buffer in ahci_commit_buf()
|
||
|
|
may do a NULL dereference if the command header 'ad->cur_cmd'
|
||
|
|
is null. Add check to avoid it.
|
||
|
|
|
||
|
|
Reported-by: Bugs SysSec <address@hidden>
|
||
|
|
Signed-off-by: Prasad J Pandit <address@hidden>
|
||
|
|
|
||
|
|
Signed-off-by: Jiajie Li <lijiajie11@huawei.com>
|
||
|
|
Signed-off-by: Yan Wang <wangyan122@huawei.com>
|
||
|
|
---
|
||
|
|
hw/ide/ahci.c | 6 ++++--
|
||
|
|
1 file changed, 4 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
|
||
|
|
index a94c6e26fb..256b58026a 100644
|
||
|
|
--- a/hw/ide/ahci.c
|
||
|
|
+++ b/hw/ide/ahci.c
|
||
|
|
@@ -1459,8 +1459,10 @@ static void ahci_commit_buf(const IDEDMA *dma, uint32_t tx_bytes)
|
||
|
|
{
|
||
|
|
AHCIDevice *ad = DO_UPCAST(AHCIDevice, dma, dma);
|
||
|
|
|
||
|
|
- tx_bytes += le32_to_cpu(ad->cur_cmd->status);
|
||
|
|
- ad->cur_cmd->status = cpu_to_le32(tx_bytes);
|
||
|
|
+ if (ad->cur_cmd) {
|
||
|
|
+ tx_bytes += le32_to_cpu(ad->cur_cmd->status);
|
||
|
|
+ ad->cur_cmd->status = cpu_to_le32(tx_bytes);
|
||
|
|
+ }
|
||
|
|
}
|
||
|
|
|
||
|
|
static int ahci_dma_rw_buf(const IDEDMA *dma, bool is_write)
|
||
|
|
--
|
||
|
|
2.27.0
|
||
|
|
|