* [Qemu-devel] [PATCH] 9pfs: fix information leak in xattr read
@ 2016-09-27 4:44 Li Qiang
2016-09-28 6:42 ` Li Qiang
0 siblings, 1 reply; 4+ messages in thread
From: Li Qiang @ 2016-09-27 4:44 UTC (permalink / raw)
To: aneesh.kumar, groug, qemu-devel; +Cc: Li Qiang
From: Li Qiang <liqiang6-s@360.cn>
9pfs uses g_malloc() to allocate the xattr memory space, if the guest
reads this memory before writing to it, this will leak host heap
memory to the guest. This patch avoid this.
Signed-off-by: Li Qiang <liqiang6-s@360.cn>
---
hw/9pfs/9p.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index b1ff8e7..4db1bd8 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -3291,7 +3291,7 @@ static void v9fs_xattrcreate(void *opaque)
xattr_fidp->fs.xattr.flags = flags;
v9fs_string_init(&xattr_fidp->fs.xattr.name);
v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);
- xattr_fidp->fs.xattr.value = g_malloc(size);
+ xattr_fidp->fs.xattr.value = g_malloc0(size);
err = offset;
put_fid(pdu, file_fidp);
out_nofid:
--
1.8.3.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] 9pfs: fix information leak in xattr read
2016-09-27 4:44 [Qemu-devel] [PATCH] 9pfs: fix information leak in xattr read Li Qiang
@ 2016-09-28 6:42 ` Li Qiang
2016-09-28 8:47 ` Greg Kurz
0 siblings, 1 reply; 4+ messages in thread
From: Li Qiang @ 2016-09-28 6:42 UTC (permalink / raw)
To: aneesh.kumar, Greg Kurz, qemu-devel; +Cc: Li Qiang
Hi Greg,
What about this patch?
It seems you have forget it.
2016-09-27 12:44 GMT+08:00 Li Qiang <liq3ea@gmail.com>:
> From: Li Qiang <liqiang6-s@360.cn>
>
> 9pfs uses g_malloc() to allocate the xattr memory space, if the guest
> reads this memory before writing to it, this will leak host heap
> memory to the guest. This patch avoid this.
>
> Signed-off-by: Li Qiang <liqiang6-s@360.cn>
> ---
> hw/9pfs/9p.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> index b1ff8e7..4db1bd8 100644
> --- a/hw/9pfs/9p.c
> +++ b/hw/9pfs/9p.c
> @@ -3291,7 +3291,7 @@ static void v9fs_xattrcreate(void *opaque)
> xattr_fidp->fs.xattr.flags = flags;
> v9fs_string_init(&xattr_fidp->fs.xattr.name);
> v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);
> - xattr_fidp->fs.xattr.value = g_malloc(size);
> + xattr_fidp->fs.xattr.value = g_malloc0(size);
> err = offset;
> put_fid(pdu, file_fidp);
> out_nofid:
> --
> 1.8.3.1
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] 9pfs: fix information leak in xattr read
2016-09-28 6:42 ` Li Qiang
@ 2016-09-28 8:47 ` Greg Kurz
2016-09-28 9:02 ` Li Qiang
0 siblings, 1 reply; 4+ messages in thread
From: Greg Kurz @ 2016-09-28 8:47 UTC (permalink / raw)
To: Li Qiang; +Cc: aneesh.kumar, qemu-devel, Li Qiang
On Wed, 28 Sep 2016 14:42:05 +0800
Li Qiang <liq3ea@gmail.com> wrote:
> Hi Greg,
>
> What about this patch?
>
> It seems you have forget it.
>
Heh not exactly... I'm just wondering why we allocate xattr_fidp->fs.xattr.value
here if we don't use it. Can you please investigate if it is possible to defer
allocation until it is really needed ?
Thanks.
--
Greg
> 2016-09-27 12:44 GMT+08:00 Li Qiang <liq3ea@gmail.com>:
>
> > From: Li Qiang <liqiang6-s@360.cn>
> >
> > 9pfs uses g_malloc() to allocate the xattr memory space, if the guest
> > reads this memory before writing to it, this will leak host heap
> > memory to the guest. This patch avoid this.
> >
> > Signed-off-by: Li Qiang <liqiang6-s@360.cn>
> > ---
> > hw/9pfs/9p.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> > index b1ff8e7..4db1bd8 100644
> > --- a/hw/9pfs/9p.c
> > +++ b/hw/9pfs/9p.c
> > @@ -3291,7 +3291,7 @@ static void v9fs_xattrcreate(void *opaque)
> > xattr_fidp->fs.xattr.flags = flags;
> > v9fs_string_init(&xattr_fidp->fs.xattr.name);
> > v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);
> > - xattr_fidp->fs.xattr.value = g_malloc(size);
> > + xattr_fidp->fs.xattr.value = g_malloc0(size);
> > err = offset;
> > put_fid(pdu, file_fidp);
> > out_nofid:
> > --
> > 1.8.3.1
> >
> >
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [Qemu-devel] [PATCH] 9pfs: fix information leak in xattr read
2016-09-28 8:47 ` Greg Kurz
@ 2016-09-28 9:02 ` Li Qiang
0 siblings, 0 replies; 4+ messages in thread
From: Li Qiang @ 2016-09-28 9:02 UTC (permalink / raw)
To: Greg Kurz; +Cc: aneesh.kumar, qemu-devel, Li Qiang
Yes, allocation here is also causing a memory leak issue.
I will try to look more at it.
On 2016-09-28 16:47 GMT+08:00 Greg Kurz <groug@kaod.org> wrote:
>
>
> Heh not exactly... I'm just wondering why we allocate
> xattr_fidp->fs.xattr.value
> here if we don't use it. Can you please investigate if it is possible to
> defer
> allocation until it is really needed ?
>
> Thanks.
>
> --
> Greg
>
> > 2016-09-27 12:44 GMT+08:00 Li Qiang <liq3ea@gmail.com>:
> >
> > > From: Li Qiang <liqiang6-s@360.cn>
> > >
> > > 9pfs uses g_malloc() to allocate the xattr memory space, if the guest
> > > reads this memory before writing to it, this will leak host heap
> > > memory to the guest. This patch avoid this.
> > >
> > > Signed-off-by: Li Qiang <liqiang6-s@360.cn>
> > > ---
> > > hw/9pfs/9p.c | 2 +-
> > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
> > > index b1ff8e7..4db1bd8 100644
> > > --- a/hw/9pfs/9p.c
> > > +++ b/hw/9pfs/9p.c
> > > @@ -3291,7 +3291,7 @@ static void v9fs_xattrcreate(void *opaque)
> > > xattr_fidp->fs.xattr.flags = flags;
> > > v9fs_string_init(&xattr_fidp->fs.xattr.name);
> > > v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);
> > > - xattr_fidp->fs.xattr.value = g_malloc(size);
> > > + xattr_fidp->fs.xattr.value = g_malloc0(size);
> > > err = offset;
> > > put_fid(pdu, file_fidp);
> > > out_nofid:
> > > --
> > > 1.8.3.1
> > >
> > >
>
>
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2016-09-28 9:02 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2016-09-27 4:44 [Qemu-devel] [PATCH] 9pfs: fix information leak in xattr read Li Qiang
2016-09-28 6:42 ` Li Qiang
2016-09-28 8:47 ` Greg Kurz
2016-09-28 9:02 ` Li Qiang
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.