Re: [PATCH 1/7] vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info

From: Li Qiang <liq3ea@gmail.com>
To: P J P <ppandit@redhat.com>
Cc: marcandre lureau <marcandre.lureau@redhat.com>,
	Li Qiang <liq3ea@163.com>, Gerd Hoffmann <kraxel@redhat.com>,
	Qemu Developers <qemu-devel@nongnu.org>
Subject: Re: [PATCH 1/7] vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info
Date: Wed, 5 May 2021 17:07:20 +0800	[thread overview]
Message-ID: <CAKXe6SK_gwLad2khA9iJda2DJi2BDXSg=ZGpPUFqPQdb+V6tRw@mail.gmail.com> (raw)
In-Reply-To: <8o22o26q-9342-o822-2758-372s9s59r2qn@erqung.pbz>

P J P <ppandit@redhat.com> 于2021年5月5日周三 下午3:24写道：
>
> +-- On Tue, 4 May 2021, Li Qiang wrote --+
> | Otherwise some of the 'resp' will be leaked to guest.
> |
> | diff --git a/contrib/vhost-user-gpu/virgl.c b/contrib/vhost-user-gpu/virgl.c
> | index 9e6660c7ab..6a332d601f 100644
> |
> | +    memset(&resp, 0, sizeof(resp));
> |      if (info.capset_index == 0) {
> |          resp.capset_id = VIRTIO_GPU_CAPSET_VIRGL;
> |          virgl_renderer_get_cap_set(resp.capset_id,
>
> -   vg_ctrl_response(g, cmd, &resp.hdr, sizeof(resp));
> +   vg_ctrl_response(g, cmd, &resp.hdr, sizeof(resp.hdr));
>
> * While memset(3) is okay, should it also send header(hdr) size as 'resp_len'?
>

I don't think so. This function also set fields other than header such
as 'resp.capset_id', 'resp.capset_max_version' and so on.

Thanks,
Li Qiang

>
> Thank you.
> --
>  - P J P
> 8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
>