CVE-2016-1981: infinite loop in e1000 (bz #1299995) Fix Out-of-bounds read in usb-ehci (bz #1300234, bz #1299455) CVE-2016-2197: ahci: null pointer dereference (bz #1302952) Fix gdbstub for VSX registers for ppc64 (bz #1304377) Fix qemu-img vmdk images to work with VMware (bz #1299185)
41 lines
1.3 KiB
Diff
41 lines
1.3 KiB
Diff
From: John Snow <jsnow@redhat.com>
|
|
Date: Wed, 10 Feb 2016 13:29:40 -0500
|
|
Subject: [PATCH] ahci: Do not unmap NULL addresses
|
|
|
|
Definitely don't try to unmap a garbage address.
|
|
|
|
Reported-by: Zuozhi fzz <zuozhi.fzz@alibaba-inc.com>
|
|
Signed-off-by: John Snow <jsnow@redhat.com>
|
|
Message-id: 1454103689-13042-2-git-send-email-jsnow@redhat.com
|
|
(cherry picked from commit 99b4cb71069f109b79b27bc629fc0cf0886dbc4b)
|
|
---
|
|
hw/ide/ahci.c | 8 ++++++++
|
|
1 file changed, 8 insertions(+)
|
|
|
|
diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
|
|
index 17f1cbd..cdc9299 100644
|
|
--- a/hw/ide/ahci.c
|
|
+++ b/hw/ide/ahci.c
|
|
@@ -661,6 +661,10 @@ static bool ahci_map_fis_address(AHCIDevice *ad)
|
|
|
|
static void ahci_unmap_fis_address(AHCIDevice *ad)
|
|
{
|
|
+ if (ad->res_fis == NULL) {
|
|
+ DPRINTF(ad->port_no, "Attempt to unmap NULL FIS address\n");
|
|
+ return;
|
|
+ }
|
|
dma_memory_unmap(ad->hba->as, ad->res_fis, 256,
|
|
DMA_DIRECTION_FROM_DEVICE, 256);
|
|
ad->res_fis = NULL;
|
|
@@ -677,6 +681,10 @@ static bool ahci_map_clb_address(AHCIDevice *ad)
|
|
|
|
static void ahci_unmap_clb_address(AHCIDevice *ad)
|
|
{
|
|
+ if (ad->lst == NULL) {
|
|
+ DPRINTF(ad->port_no, "Attempt to unmap NULL CLB address\n");
|
|
+ return;
|
|
+ }
|
|
dma_memory_unmap(ad->hba->as, ad->lst, 1024,
|
|
DMA_DIRECTION_FROM_DEVICE, 1024);
|
|
ad->lst = NULL;
|