[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 01/15] virtio-net: fix map leaking on error during receive
From: |
Jason Wang |
Subject: |
[PULL 01/15] virtio-net: fix map leaking on error during receive |
Date: |
Tue, 8 Mar 2022 21:34:37 +0800 |
Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
tries to fix the use after free of the sg by caching the virtqueue
elements in an array and unmap them at once after receiving the
packets, But it forgot to unmap the cached elements on error which
will lead to leaking of mapping and other unexpected results.
Fixing this by detaching the cached elements on error. This addresses
CVE-2022-26353.
Reported-by: Victor Tom <vv474172261@gmail.com>
Cc: qemu-stable@nongnu.org
Fixes: CVE-2022-26353
Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
hw/net/virtio-net.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index cf8ab0f..65b61c8 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1867,6 +1867,7 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc,
const uint8_t *buf,
err:
for (j = 0; j < i; j++) {
+ virtqueue_detach_element(q->rx_vq, elems[j], lens[j]);
g_free(elems[j]);
}
--
2.7.4
- [PULL 00/15] Net patches, Jason Wang, 2022/03/08
- [PULL 01/15] virtio-net: fix map leaking on error during receive,
Jason Wang <=
- [PULL 02/15] vhost: Add VhostShadowVirtqueue, Jason Wang, 2022/03/08
- [PULL 03/15] vhost: Add Shadow VirtQueue kick forwarding capabilities, Jason Wang, 2022/03/08
- [PULL 04/15] vhost: Add Shadow VirtQueue call forwarding capabilities, Jason Wang, 2022/03/08
- [PULL 06/15] virtio: Add vhost_svq_get_vring_addr, Jason Wang, 2022/03/08
- [PULL 05/15] vhost: Add vhost_svq_valid_features to shadow vq, Jason Wang, 2022/03/08
- [PULL 07/15] vdpa: adapt vhost_ops callbacks to svq, Jason Wang, 2022/03/08
- [PULL 08/15] vhost: Shadow virtqueue buffers forwarding, Jason Wang, 2022/03/08
- [PULL 09/15] util: Add iova_tree_alloc_map, Jason Wang, 2022/03/08
- [PULL 10/15] util: add iova_tree_find_iova, Jason Wang, 2022/03/08
- [PULL 12/15] vdpa: Add custom IOTLB translations to SVQ, Jason Wang, 2022/03/08