[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[RFC PATCH v6 04/23] hw/virtio: Replace g_memdup() by g_memdup2()
From: |
Eugenio Pérez |
Subject: |
[RFC PATCH v6 04/23] hw/virtio: Replace g_memdup() by g_memdup2() |
Date: |
Mon, 11 Apr 2022 16:50:07 +0200 |
From: Philippe Mathieu-Daudé <philmd@redhat.com>
Per
https://discourse.gnome.org/t/port-your-module-from-g-memdup-to-g-memdup2-now/5538
The old API took the size of the memory to duplicate as a guint,
whereas most memory functions take memory sizes as a gsize. This
made it easy to accidentally pass a gsize to g_memdup(). For large
values, that would lead to a silent truncation of the size from 64
to 32 bits, and result in a heap area being returned which is
significantly smaller than what the caller expects. This can likely
be exploited in various modules to cause a heap buffer overflow.
Replace g_memdup() by the safer g_memdup2() wrapper.
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
---
hw/net/virtio-net.c | 3 ++-
hw/virtio/virtio-crypto.c | 6 +++---
2 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 1067e72b39..e4748a7e6c 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1443,7 +1443,8 @@ static void virtio_net_handle_ctrl(VirtIODevice *vdev,
VirtQueue *vq)
}
iov_cnt = elem->out_num;
- iov2 = iov = g_memdup(elem->out_sg, sizeof(struct iovec) *
elem->out_num);
+ iov2 = iov = g_memdup2(elem->out_sg,
+ sizeof(struct iovec) * elem->out_num);
s = iov_to_buf(iov, iov_cnt, 0, &ctrl, sizeof(ctrl));
iov_discard_front(&iov, &iov_cnt, sizeof(ctrl));
if (s != sizeof(ctrl)) {
diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index dcd80b904d..0e31e3cc04 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -242,7 +242,7 @@ static void virtio_crypto_handle_ctrl(VirtIODevice *vdev,
VirtQueue *vq)
}
out_num = elem->out_num;
- out_iov_copy = g_memdup(elem->out_sg, sizeof(out_iov[0]) * out_num);
+ out_iov_copy = g_memdup2(elem->out_sg, sizeof(out_iov[0]) * out_num);
out_iov = out_iov_copy;
in_num = elem->in_num;
@@ -605,11 +605,11 @@ virtio_crypto_handle_request(VirtIOCryptoReq *request)
}
out_num = elem->out_num;
- out_iov_copy = g_memdup(elem->out_sg, sizeof(out_iov[0]) * out_num);
+ out_iov_copy = g_memdup2(elem->out_sg, sizeof(out_iov[0]) * out_num);
out_iov = out_iov_copy;
in_num = elem->in_num;
- in_iov_copy = g_memdup(elem->in_sg, sizeof(in_iov[0]) * in_num);
+ in_iov_copy = g_memdup2(elem->in_sg, sizeof(in_iov[0]) * in_num);
in_iov = in_iov_copy;
if (unlikely(iov_to_buf(out_iov, out_num, 0, &req, sizeof(req))
--
2.27.0
- [RFC PATCH v6 00/23] Net Control VQ support with asid in vDPA SVQ, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 01/23] vdpa: Add missing tracing to batch mapping functions, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 03/23] util: Return void on iova_tree_remove, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 05/23] vhost: Fix bad return of descriptors to SVQ, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 04/23] hw/virtio: Replace g_memdup() by g_memdup2(),
Eugenio Pérez <=
- [RFC PATCH v6 02/23] vdpa: Fix bad index calculus at vhost_vdpa_get_vring_base, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 06/23] vdpa: Add x-svq to NetdevVhostVDPAOptions, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 07/23] vhost: move descriptor translation to vhost_svq_vring_write_descs, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 09/23] virtio-net: Expose ctrl virtqueue logic, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 11/23] virtio: Make virtqueue_alloc_element non-static, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 10/23] vdpa: Extract get features part from vhost_vdpa_get_max_queue_pairs, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 13/23] vhost: Add custom used buffer callback, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 08/23] vdpa: Fix index calculus at vhost_vdpa_svqs_start, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 14/23] vdpa: control virtqueue support on shadow virtqueue, Eugenio Pérez, 2022/04/11
- [RFC PATCH v6 15/23] vhost: Add vhost_iova_tree_find, Eugenio Pérez, 2022/04/11