commit fd6918556736ecce8b10acd581ba134ffb62d9f9
author Prasad J Pandit <pjp@fedoraproject.org> Thu May 14 00:55:39 2020 +0530
committer Paolo Bonzini <pbonzini@redhat.com> Wed Jun 10 12:10:12 2020 -0400
tree 43ab7674d72154e55c9b2dfa85024d1ddb9b727b
parent f50ab86a2620bd7e8507af865b164655ee921661

megasas: avoid NULL pointer dereference

While in megasas_handle_frame(), megasas_enqueue_frame() may
set a NULL frame into MegasasCmd object for a given 'frame_addr'
address. Add check to avoid a NULL pointer dereference issue.

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: https://bugs.launchpad.net/qemu/+bug/1878259
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
Message-Id: <20200513192540.1583887-3-ppandit@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

hw/scsi/megasas.c

diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index 6ce598c..b531d88 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -504,7 +504,7 @@
     cmd->pa = frame;
     /* Map all possible frames */
     cmd->frame = pci_dma_map(pcid, frame, &frame_size_p, 0);
-    if (frame_size_p != frame_size) {
+    if (!cmd->frame || frame_size_p != frame_size) {
         trace_megasas_qf_map_failed(cmd->index, (unsigned long)frame);
         if (cmd->frame) {
             megasas_unmap_frame(s, cmd);