[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL V2 01/15] virtio-net: fix map leaking on error during receive
From: |
Jason Wang |
Subject: |
[PULL V2 01/15] virtio-net: fix map leaking on error during receive |
Date: |
Thu, 10 Mar 2022 10:38:53 +0800 |
Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
tries to fix the use after free of the sg by caching the virtqueue
elements in an array and unmap them at once after receiving the
packets, But it forgot to unmap the cached elements on error which
will lead to leaking of mapping and other unexpected results.
Fixing this by detaching the cached elements on error. This addresses
CVE-2022-26353.
Reported-by: Victor Tom <vv474172261@gmail.com>
Cc: qemu-stable@nongnu.org
Fixes: CVE-2022-26353
Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
hw/net/virtio-net.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index b02a063..2087516 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1870,6 +1870,7 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc,
const uint8_t *buf,
err:
for (j = 0; j < i; j++) {
+ virtqueue_detach_element(q->rx_vq, elems[j], lens[j]);
g_free(elems[j]);
}
--
2.7.4
- [PULL V2 00/15] Net patches, Jason Wang, 2022/03/09
- [PULL V2 01/15] virtio-net: fix map leaking on error during receive,
Jason Wang <=
- [PULL V2 02/15] vhost: Add VhostShadowVirtqueue, Jason Wang, 2022/03/09
- [PULL V2 03/15] vhost: Add Shadow VirtQueue kick forwarding capabilities, Jason Wang, 2022/03/09
- [PULL V2 05/15] vhost: Add vhost_svq_valid_features to shadow vq, Jason Wang, 2022/03/09
- [PULL V2 04/15] vhost: Add Shadow VirtQueue call forwarding capabilities, Jason Wang, 2022/03/09
- [PULL V2 06/15] virtio: Add vhost_svq_get_vring_addr, Jason Wang, 2022/03/09
- [PULL V2 07/15] vdpa: adapt vhost_ops callbacks to svq, Jason Wang, 2022/03/09
- [PULL V2 08/15] vhost: Shadow virtqueue buffers forwarding, Jason Wang, 2022/03/09
- [PULL V2 09/15] util: Add iova_tree_alloc_map, Jason Wang, 2022/03/09
- [PULL V2 10/15] util: add iova_tree_find_iova, Jason Wang, 2022/03/09
- [PULL V2 11/15] vhost: Add VhostIOVATree, Jason Wang, 2022/03/09