Potential Memory Leak Bugs in drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).

Potential Memory Leak Bugs in drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).

[Dongyang Zhan]

Hi,
My name is Dongyang Zhan, I am a security researcher.
Currently, I found two possible memory bugs in
drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).
I hope you can help me to confirm them. Thank you.

The first one is resp_buf will not be release in
virtio_gpu_cmd_get_display_info() with the condition
(resp_size <= MAX_INLINE_RESP_SIZE) in virtio_gpu_alloc_cmd_resp().

int virtio_gpu_cmd_get_display_info(struct virtio_gpu_device *vgdev)
{
struct virtio_gpu_ctrl_hdr *cmd_p;
struct virtio_gpu_vbuffer *vbuf;
void *resp_buf;
...
resp_buf = kzalloc(sizeof(struct virtio_gpu_resp_display_info), GFP_KERNEL);
if (!resp_buf)
     return -ENOMEM;
cmd_p =virtio_gpu_alloc_cmd_resp(vgdev,&virtio_gpu_cmd_get_display_info_cb,
&vbuf,
sizeof(*cmd_p), sizeof(struct virtio_gpu_resp_display_info),resp_buf); //
memset(cmd_p, 0, sizeof(*cmd_p));
...
return 0;
}

virtio_gpu_get_vbuf(struct virtio_gpu_device *vgdev,
   int size, int resp_size, void *resp_buf,
   virtio_gpu_resp_cb resp_cb)
{
struct virtio_gpu_vbuffer *vbuf;

vbuf = kmem_cache_zalloc(vgdev->vbufs, GFP_KERNEL);
if (!vbuf)
return ERR_PTR(-ENOMEM);

BUG_ON(size > MAX_INLINE_CMD_SIZE);
vbuf->buf = (void *)vbuf + sizeof(*vbuf);
vbuf->size = size;

vbuf->resp_cb = resp_cb;
vbuf->resp_size = resp_size;
if (resp_size <= MAX_INLINE_RESP_SIZE)
vbuf->resp_buf = (void *)vbuf->buf + size; // resp_buf will never be released.
else
vbuf->resp_buf = resp_buf;
BUG_ON(!vbuf->resp_buf);
return vbuf;
}

The second one is in virtio_gpu_cmd_get_edids(), which is similar with
the last one. resp_buf will not be released.
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: Potential Memory Leak Bugs in drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).

[Gerd Hoffmann]

On Thu, May 28, 2020 at 03:57:05PM +0800, Dongyang Zhan wrote:
> Hi,
> My name is Dongyang Zhan, I am a security researcher.
> Currently, I found two possible memory bugs in
> drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).
> I hope you can help me to confirm them. Thank you.

Sorry.  Not confirmed.  You should do a better job verifying your
claims before bugging people.

> The first one is resp_buf will not be release in
> virtio_gpu_cmd_get_display_info() with the condition
> (resp_size <= MAX_INLINE_RESP_SIZE) in virtio_gpu_alloc_cmd_resp().

In that code path resp_size equals sizeof(struct
virtio_gpu_resp_display_info) which is larger than MAX_INLINE_RESP_SIZE
so the condition is never true and no leak happens.

take care,
  Gerd

_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel

Re: Potential Memory Leak Bugs in drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).

[Dongyang Zhan]

Ok, thanks!

Gerd Hoffmann <kraxel@redhat.com> 于2020年5月28日周四 下午4:25写道：
>
> On Thu, May 28, 2020 at 03:57:05PM +0800, Dongyang Zhan wrote:
> > Hi,
> > My name is Dongyang Zhan, I am a security researcher.
> > Currently, I found two possible memory bugs in
> > drivers/gpu/drm/virtio/virtgpu_vq.c (Linux 5.6).
> > I hope you can help me to confirm them. Thank you.
>
> Sorry.  Not confirmed.  You should do a better job verifying your
> claims before bugging people.
>
> > The first one is resp_buf will not be release in
> > virtio_gpu_cmd_get_display_info() with the condition
> > (resp_size <= MAX_INLINE_RESP_SIZE) in virtio_gpu_alloc_cmd_resp().
>
> In that code path resp_size equals sizeof(struct
> virtio_gpu_resp_display_info) which is larger than MAX_INLINE_RESP_SIZE
> so the condition is never true and no leak happens.
>
> take care,
>   Gerd
>
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel