From b22f83d8df481800ce43d1915a98c127a9de2258 Mon Sep 17 00:00:00 2001 From: Alexandra Diupina Date: Fri, 29 Dec 2023 18:26:47 +0300 Subject: [PATCH] esp: check for NULL result from scsi_device_find() Add a 'current_lun' check for a null value to avoid null pointer dereferencing and recover host if NULL return Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 4eb8606560 (esp: store lun coming from the MESSAGE OUT phase) Signed-off-by: Alexandra Diupina Message-ID: <20231229152647.19699-1-adiupina@astralinux.ru> Signed-off-by: Paolo Bonzini --- hw/scsi/esp.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c index 9b11d8c573..d2cae79194 100644 --- a/hw/scsi/esp.c +++ b/hw/scsi/esp.c @@ -292,6 +292,15 @@ static void do_command_phase(ESPState *s) esp_fifo_pop_buf(&s->cmdfifo, buf, cmdlen); current_lun = scsi_device_find(&s->bus, 0, s->current_dev->id, s->lun); + if (!current_lun) { + /* No such drive */ + s->rregs[ESP_RSTAT] = 0; + s->rregs[ESP_RINTR] = INTR_DC; + s->rregs[ESP_RSEQ] = SEQ_0; + esp_raise_irq(s); + return; + } + s->current_req = scsi_req_new(current_lun, 0, s->lun, buf, cmdlen, s); datalen = scsi_req_enqueue(s->current_req); s->ti_size = datalen;