All of lore.kernel.org
 help / color / mirror / Atom feed
From: Gerd Hoffmann <kraxel@redhat.com>
To: qemu-devel@nongnu.org
Cc: "Michael S. Tsirkin" <mst@redhat.com>,
	"Cornelia Huck" <cohuck@redhat.com>, "Li Qiang" <liq3ea@163.com>,
	"Gerd Hoffmann" <kraxel@redhat.com>,
	"Paolo Bonzini" <pbonzini@redhat.com>,
	"Marc-André Lureau" <marcandre.lureau@redhat.com>
Subject: [PULL 05/23] vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544)
Date: Thu, 27 May 2021 16:23:22 +0200	[thread overview]
Message-ID: <20210527142340.1352791-6-kraxel@redhat.com> (raw)
In-Reply-To: <20210527142340.1352791-1-kraxel@redhat.com>

From: Li Qiang <liq3ea@163.com>

The 'res->iov' will be leaked if the guest trigger following sequences:

	virgl_cmd_create_resource_2d
	virgl_resource_attach_backing
	virgl_cmd_resource_unref

This patch fixes this.

Fixes: CVE-2021-3544
Reported-by: Li Qiang <liq3ea@163.com>
virtio-gpu fix: 5e8e3c4c75 ("virtio-gpu: fix resource leak
in virgl_cmd_resource_unref"

Signed-off-by: Li Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-6-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 contrib/vhost-user-gpu/virgl.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/contrib/vhost-user-gpu/virgl.c b/contrib/vhost-user-gpu/virgl.c
index 6a332d601f80..c669d73a1dbe 100644
--- a/contrib/vhost-user-gpu/virgl.c
+++ b/contrib/vhost-user-gpu/virgl.c
@@ -108,9 +108,16 @@ virgl_cmd_resource_unref(VuGpu *g,
                          struct virtio_gpu_ctrl_command *cmd)
 {
     struct virtio_gpu_resource_unref unref;
+    struct iovec *res_iovs = NULL;
+    int num_iovs = 0;
 
     VUGPU_FILL_CMD(unref);
 
+    virgl_renderer_resource_detach_iov(unref.resource_id,
+                                       &res_iovs,
+                                       &num_iovs);
+    g_free(res_iovs);
+
     virgl_renderer_resource_unref(unref.resource_id);
 }
 
-- 
2.31.1



  parent reply	other threads:[~2021-05-27 14:30 UTC|newest]

Thread overview: 27+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-05-27 14:23 [PULL 00/23] Vga 20210527 patches Gerd Hoffmann
2021-05-27 14:23 ` [PULL 01/23] vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info (CVE-2021-3545) Gerd Hoffmann
2021-05-27 14:23 ` [PULL 02/23] vhost-user-gpu: fix resource leak in 'vg_resource_create_2d' (CVE-2021-3544) Gerd Hoffmann
2021-06-03 15:54   ` Peter Maydell
2021-05-27 14:23 ` [PULL 03/23] vhost-user-gpu: fix memory leak in vg_resource_attach_backing (CVE-2021-3544) Gerd Hoffmann
2021-05-27 14:23 ` [PULL 04/23] vhost-user-gpu: fix memory leak while calling 'vg_resource_unref' (CVE-2021-3544) Gerd Hoffmann
2021-05-27 14:23 ` Gerd Hoffmann [this message]
2021-05-27 14:23 ` [PULL 06/23] vhost-user-gpu: fix memory leak in 'virgl_resource_attach_backing' (CVE-2021-3544) Gerd Hoffmann
2021-05-27 14:23 ` [PULL 07/23] vhost-user-gpu: fix OOB write in 'virgl_cmd_get_capset' (CVE-2021-3546) Gerd Hoffmann
2021-05-27 14:23 ` [PULL 08/23] vhost-user-gpu: abstract vg_cleanup_mapping_iov Gerd Hoffmann
2021-05-27 14:23 ` [PULL 09/23] hw/display/qxl: Set pci rom address aligned with page size Gerd Hoffmann
2021-05-27 14:23 ` [PULL 10/23] ui: Get the fd associated with udmabuf driver Gerd Hoffmann
2021-05-27 14:23 ` [PULL 11/23] headers: Add udmabuf.h Gerd Hoffmann
2021-05-27 14:23 ` [PULL 12/23] virtio-gpu: Add udmabuf helpers Gerd Hoffmann
2021-05-27 14:23 ` [PULL 13/23] stubs: Add stubs for " Gerd Hoffmann
2021-05-27 14:23 ` [PULL 14/23] virtio-gpu: Add virtio_gpu_find_check_resource Gerd Hoffmann
2021-05-27 14:23 ` [PULL 15/23] virtio-gpu: Refactor virtio_gpu_set_scanout Gerd Hoffmann
2021-06-02 14:08   ` Alexander Bulekov
2021-05-27 14:23 ` [PULL 16/23] virtio-gpu: Refactor virtio_gpu_create_mapping_iov Gerd Hoffmann
2021-05-27 14:23 ` [PULL 17/23] virtio-gpu: Add initial definitions for blob resources Gerd Hoffmann
2021-05-27 14:23 ` [PULL 18/23] virtio-gpu: Add virtio_gpu_resource_create_blob Gerd Hoffmann
2021-05-27 14:23 ` [PULL 19/23] ui/pixman: Add qemu_pixman_to_drm_format() Gerd Hoffmann
2021-05-27 14:23 ` [PULL 20/23] virtio-gpu: Add helpers to create and destroy dmabuf objects Gerd Hoffmann
2021-05-27 14:23 ` [PULL 21/23] virtio-gpu: Factor out update scanout Gerd Hoffmann
2021-05-27 14:23 ` [PULL 22/23] virtio-gpu: Add virtio_gpu_set_scanout_blob Gerd Hoffmann
2021-05-27 14:23 ` [PULL 23/23] virtio-gpu: Update cursor data using blob Gerd Hoffmann
2021-05-30 18:55 ` [PULL 00/23] Vga 20210527 patches Peter Maydell

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210527142340.1352791-6-kraxel@redhat.com \
    --to=kraxel@redhat.com \
    --cc=cohuck@redhat.com \
    --cc=liq3ea@163.com \
    --cc=marcandre.lureau@redhat.com \
    --cc=mst@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.