* Potential Memory Leak Bugs in drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).
@ 2020-05-28 7:57 Dongyang Zhan
2020-05-28 8:25 ` Gerd Hoffmann
0 siblings, 1 reply; 3+ messages in thread
From: Dongyang Zhan @ 2020-05-28 7:57 UTC (permalink / raw)
To: airlied, kraxel; +Cc: dri-devel, virtualization
Hi,
My name is Dongyang Zhan, I am a security researcher.
Currently, I found two possible memory bugs in
drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).
I hope you can help me to confirm them. Thank you.
The first one is resp_buf will not be release in
virtio_gpu_cmd_get_display_info() with the condition
(resp_size <= MAX_INLINE_RESP_SIZE) in virtio_gpu_alloc_cmd_resp().
int virtio_gpu_cmd_get_display_info(struct virtio_gpu_device *vgdev)
{
struct virtio_gpu_ctrl_hdr *cmd_p;
struct virtio_gpu_vbuffer *vbuf;
void *resp_buf;
...
resp_buf = kzalloc(sizeof(struct virtio_gpu_resp_display_info), GFP_KERNEL);
if (!resp_buf)
return -ENOMEM;
cmd_p =virtio_gpu_alloc_cmd_resp(vgdev,&virtio_gpu_cmd_get_display_info_cb,
&vbuf,
sizeof(*cmd_p), sizeof(struct virtio_gpu_resp_display_info),resp_buf); //
memset(cmd_p, 0, sizeof(*cmd_p));
...
return 0;
}
virtio_gpu_get_vbuf(struct virtio_gpu_device *vgdev,
int size, int resp_size, void *resp_buf,
virtio_gpu_resp_cb resp_cb)
{
struct virtio_gpu_vbuffer *vbuf;
vbuf = kmem_cache_zalloc(vgdev->vbufs, GFP_KERNEL);
if (!vbuf)
return ERR_PTR(-ENOMEM);
BUG_ON(size > MAX_INLINE_CMD_SIZE);
vbuf->buf = (void *)vbuf + sizeof(*vbuf);
vbuf->size = size;
vbuf->resp_cb = resp_cb;
vbuf->resp_size = resp_size;
if (resp_size <= MAX_INLINE_RESP_SIZE)
vbuf->resp_buf = (void *)vbuf->buf + size; // resp_buf will never be released.
else
vbuf->resp_buf = resp_buf;
BUG_ON(!vbuf->resp_buf);
return vbuf;
}
The second one is in virtio_gpu_cmd_get_edids(), which is similar with
the last one. resp_buf will not be released.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Potential Memory Leak Bugs in drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).
2020-05-28 7:57 Potential Memory Leak Bugs in drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6) Dongyang Zhan
@ 2020-05-28 8:25 ` Gerd Hoffmann
2020-05-29 2:05 ` Dongyang Zhan
0 siblings, 1 reply; 3+ messages in thread
From: Gerd Hoffmann @ 2020-05-28 8:25 UTC (permalink / raw)
To: Dongyang Zhan; +Cc: airlied, dri-devel, virtualization
On Thu, May 28, 2020 at 03:57:05PM +0800, Dongyang Zhan wrote:
> Hi,
> My name is Dongyang Zhan, I am a security researcher.
> Currently, I found two possible memory bugs in
> drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).
> I hope you can help me to confirm them. Thank you.
Sorry. Not confirmed. You should do a better job verifying your
claims before bugging people.
> The first one is resp_buf will not be release in
> virtio_gpu_cmd_get_display_info() with the condition
> (resp_size <= MAX_INLINE_RESP_SIZE) in virtio_gpu_alloc_cmd_resp().
In that code path resp_size equals sizeof(struct
virtio_gpu_resp_display_info) which is larger than MAX_INLINE_RESP_SIZE
so the condition is never true and no leak happens.
take care,
Gerd
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: Potential Memory Leak Bugs in drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).
2020-05-28 8:25 ` Gerd Hoffmann
@ 2020-05-29 2:05 ` Dongyang Zhan
0 siblings, 0 replies; 3+ messages in thread
From: Dongyang Zhan @ 2020-05-29 2:05 UTC (permalink / raw)
To: Gerd Hoffmann; +Cc: airlied, dri-devel, virtualization
Ok, thanks!
Gerd Hoffmann <kraxel@redhat.com> 于2020年5月28日周四 下午4:25写道:
>
> On Thu, May 28, 2020 at 03:57:05PM +0800, Dongyang Zhan wrote:
> > Hi,
> > My name is Dongyang Zhan, I am a security researcher.
> > Currently, I found two possible memory bugs in
> > drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).
> > I hope you can help me to confirm them. Thank you.
>
> Sorry. Not confirmed. You should do a better job verifying your
> claims before bugging people.
>
> > The first one is resp_buf will not be release in
> > virtio_gpu_cmd_get_display_info() with the condition
> > (resp_size <= MAX_INLINE_RESP_SIZE) in virtio_gpu_alloc_cmd_resp().
>
> In that code path resp_size equals sizeof(struct
> virtio_gpu_resp_display_info) which is larger than MAX_INLINE_RESP_SIZE
> so the condition is never true and no leak happens.
>
> take care,
> Gerd
>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-05-29 6:47 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-05-28 7:57 Potential Memory Leak Bugs in drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6) Dongyang Zhan
2020-05-28 8:25 ` Gerd Hoffmann
2020-05-29 2:05 ` Dongyang Zhan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).