From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36142) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a4O9P-0000BU-DS for qemu-devel@nongnu.org; Thu, 03 Dec 2015 02:18:00 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1a4O9M-000745-7M for qemu-devel@nongnu.org; Thu, 03 Dec 2015 02:17:59 -0500 Received: from mail-wm0-x236.google.com ([2a00:1450:400c:c09::236]:33225) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1a4O9L-00073z-U8 for qemu-devel@nongnu.org; Thu, 03 Dec 2015 02:17:56 -0500 Received: by wmec201 with SMTP id c201so12679990wme.0 for ; Wed, 02 Dec 2015 23:17:55 -0800 (PST) Content-Type: multipart/alternative; boundary="Apple-Mail=_B04746F8-F859-4E1A-ABDB-7DB85BDE9D45" Mime-Version: 1.0 (Mac OS X Mail 9.1 \(3096.5\)) From: Dmitry Fleytman In-Reply-To: Date: Thu, 3 Dec 2015 09:17:52 +0200 Message-Id: <66A887B2-7CFF-45F9-AD7F-1381F8B1F318@daynix.com> References: Subject: Re: [Qemu-devel] net: vmxnet3: memory leakage issue List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: P J P , Jason Wang Cc: Qinghao Tang , qemu-devel@nongnu.org --Apple-Mail=_B04746F8-F859-4E1A-ABDB-7DB85BDE9D45 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset=utf-8 Hello Prasad, The patch is good. Jason, would you apply is from attachment or should it be resent by "git = send-email=E2=80=9D? Acked-by: Dmitry Fleytman > ~Dmitry > On 2 Dec 2015, at 14:17 PM, P J P wrote: >=20 > Hello Dmitry, all >=20 > A memory leakage issue was reported by Mr Qinghao Tang, CC'd here. >=20 > In that, the Qemu VMXNET3 paravirtual device emulator does not check = if the device is already active, before activating it. This leads to = host memory leakage via calls to vmxnet_tx_pkt_init(), which calls = g_malloc0(). >=20 > =3D=3D=3D > static void vmxnet3_activate_device(VMXNET3State *s) > { > ... > /* Preallocate TX packet wrapper */ > VMW_CFPRN("Max TX fragments is %u", s->max_tx_frags); > vmxnet_tx_pkt_init(&s->tx_pkt, s->max_tx_frags, s->peer_has_vhdr); > ... > } > =3D=3D=3D >=20 > A malicious guest driver could use this flaw to leak excessive memory = on the host, eventually killing the Qemu process. >=20 > Please see attached herein is a proposed (tested)patch which fixes = this issue. Please let me know if it's okay or requires any changes. >=20 > Thank you. > -- > Prasad J Pandit / Red Hat Product Security Team > 47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B = 041F<0001-net-vmxnet3-avoid-multiple-activations-of-device.patch> --Apple-Mail=_B04746F8-F859-4E1A-ABDB-7DB85BDE9D45 Content-Transfer-Encoding: quoted-printable Content-Type: text/html; charset=utf-8 Hello Prasad,

The patch is good.

Jason, would you = apply is from attachment or should it be resent by "git = send-email=E2=80=9D?

Acked-by: Dmitry Fleytman <dmitry@daynix.com>

~Dmitry

On = 2 Dec 2015, at 14:17 PM, P J P <ppandit@redhat.com> wrote:

= Hello Dmitry, all

A memory leakage = issue was reported by Mr Qinghao Tang, CC'd here.

In that, the Qemu VMXNET3 paravirtual device emulator does = not check if the device is already active, before activating it. This = leads to host memory leakage via calls to vmxnet_tx_pkt_init(), which = calls g_malloc0().

=3D=3D=3D
static void vmxnet3_activate_device(VMXNET3State *s)
{
  ...
=   /* Preallocate TX packet wrapper */
=   VMW_CFPRN("Max TX fragments is %u", s->max_tx_frags);
  vmxnet_tx_pkt_init(&s->tx_pkt, = s->max_tx_frags, s->peer_has_vhdr);
=   ...
}
=3D=3D=3D

A malicious guest driver could use this flaw to leak = excessive memory on the host, eventually killing the Qemu process.

Please see attached herein is a proposed = (tested)patch which fixes this issue. Please let me know if it's okay or = requires any changes.

Thank you.
--
Prasad J Pandit / Red Hat Product Security = Team
47AF CE69 3A90 54AA 9045 1053 DD13 3D32 FE5B = 041F<0001-net-vmxnet= 3-avoid-multiple-activations-of-device.patch>

= --Apple-Mail=_B04746F8-F859-4E1A-ABDB-7DB85BDE9D45--