Red Hat Bugzilla – Bug 744780
use-after-free in QEMU SCSI target code
Last modified: 2013-01-09 19:26:09 EST
Description of problem: I found a use-after-free in QEMU's SCSI target code. Upstream it is easily triggered by ejecting a SCSI CD-ROM during anaconda's media test step. No known reproducer for RHEL6 (we do not have SCSI CD-ROMs), but fixing it is a good idea anyway because it can be triggered by the guest just by cancelling SCSI commands. Version-Release number of selected component (if applicable): qemu-kvm-0.12.1.2-2.194.el6
(In reply to comment #0) > Description of problem: > I found a use-after-free in QEMU's SCSI target code. Upstream it is easily > triggered by ejecting a SCSI CD-ROM during anaconda's media test step. No > known reproducer for RHEL6 (we do not have SCSI CD-ROMs), but fixing it is a > good idea anyway because it can be triggered by the guest just by cancelling > SCSI commands. > > Version-Release number of selected component (if applicable): > qemu-kvm-0.12.1.2-2.194.el6 Since we don't support scsi at all for now, how can this be effective? Shouldn't we wait for 6.3?
USB implies SCSI. :(
> but fixing it is a > good idea anyway because it can be triggered by the guest just by cancelling > SCSI commands. > Hi,Paolo Would you please provide a efficient way to reproduce this issue?as you mentioned that "can be triggered by the guest just by cancelling SCSI commands."? please qe detailed steps? thanks
I don't have a reproducer for RHEL6 right now, but I can try.
(In reply to comment #5) > I don't have a reproducer for RHEL6 right now, but I can try. Hi,Paolo Would you please tell me do you have any idea to reproduce this issue,thanks
Is it fine to reproduce it with additional patches to QEMU?
(In reply to comment #12) > Is it fine to reproduce it with additional patches to QEMU? Sure,thanks
Moving to ON_QA because Errata Tool did not do it
> known reproducer for RHEL6 (we do not have SCSI CD-ROMs), but fixing it is a > good idea anyway because it can be triggered by the guest just by cancelling > SCSI commands. Hi,Paolo Since rhel6 have no scsi-cd,so we can not trigger this issue directly.in rhel6.2,USB implies SCSI.so,our qe will do the following things to verify this issue,it's ok for you? 1.Do usb functional testing. 2.check whether this this patch is applied to rhel6.
Since rhel6 have no scsi-cd,so we can not trigger this issue directly.in rhel6.2,USB implies SCSI.so,our qe will do the following things to verify this issue. Verified this issue with qemu-kvm-0.12.1.2-2.207.el6 1.Do usb functional testing,did find regression issues. https://tcms.engineering.redhat.com/run/29985/ 2.check whether this this patch is applied to rhel6. #rpm -qa --changelog qemu-kvm | grep 744780 - kvm-scsi-fix-accounting-of-writes.patch [bz#744780] - kvm-scsi-disk-bump-SCSIRequest-reference-count-until-aio.patch [bz#744780] - Resolves: bz#744780
Technical note added. If any revisions are required, please edit the "Technical Notes" field accordingly. All revisions will be proofread by the Engineering Content Services team. New Contents: In rare cases, QEMU could handle a SCSI request by using it after its memory had been freed. This could lead to a segmentation fault. SCSI requests are used by QEMU as part of emulating USB mass storage devices.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. http://rhn.redhat.com/errata/RHSA-2011-1531.html