[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PULL 07/15] vhost-user-bridge: fix recvmsg iovlen
From: |
Paolo Bonzini |
Subject: |
[Qemu-devel] [PULL 07/15] vhost-user-bridge: fix recvmsg iovlen |
Date: |
Mon, 26 Nov 2018 20:40:27 +0100 |
From: Marc-André Lureau <address@hidden>
After iov_discard_front(), the iov may be smaller than its initial
size. Fixes the heap-buffer-overflow spotted by ASAN:
==9036==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6060000001e0
at pc 0x7fe632eca3f0 bp 0x7ffddc4a05a0 sp 0x7ffddc49fd48
WRITE of size 32 at 0x6060000001e0 thread T0
#0 0x7fe632eca3ef (/lib64/libasan.so.5+0x773ef)
#1 0x7fe632ecad23 in __interceptor_recvmsg (/lib64/libasan.so.5+0x77d23)
#2 0x561e7491936b in vubr_backend_recv_cb
/home/elmarco/src/qemu/tests/vhost-user-bridge.c:333
#3 0x561e74917711 in dispatcher_wait
/home/elmarco/src/qemu/tests/vhost-user-bridge.c:160
#4 0x561e7491c3b5 in vubr_run
/home/elmarco/src/qemu/tests/vhost-user-bridge.c:725
#5 0x561e7491c85c in main
/home/elmarco/src/qemu/tests/vhost-user-bridge.c:806
#6 0x7fe631a6c412 in __libc_start_main (/lib64/libc.so.6+0x24412)
#7 0x561e7491667d in _start
(/home/elmarco/src/qemu/build/tests/vhost-user-bridge+0x3967d)
0x6060000001e0 is located 0 bytes to the right of 64-byte region
[0x6060000001a0,0x6060000001e0)
allocated by thread T0 here:
#0 0x7fe632f42848 in __interceptor_malloc (/lib64/libasan.so.5+0xef848)
#1 0x561e7493acd8 in virtqueue_alloc_element
/home/elmarco/src/qemu/contrib/libvhost-user/libvhost-user.c:1848
#2 0x561e7493c2a8 in vu_queue_pop
/home/elmarco/src/qemu/contrib/libvhost-user/libvhost-user.c:1954
#3 0x561e749189bf in vubr_backend_recv_cb
/home/elmarco/src/qemu/tests/vhost-user-bridge.c:297
#4 0x561e74917711 in dispatcher_wait
/home/elmarco/src/qemu/tests/vhost-user-bridge.c:160
#5 0x561e7491c3b5 in vubr_run
/home/elmarco/src/qemu/tests/vhost-user-bridge.c:725
#6 0x561e7491c85c in main
/home/elmarco/src/qemu/tests/vhost-user-bridge.c:806
#7 0x7fe631a6c412 in __libc_start_main (/lib64/libc.so.6+0x24412)
SUMMARY: AddressSanitizer: heap-buffer-overflow (/lib64/libasan.so.5+0x773ef)
Shadow bytes around the buggy address:
0x0c0c7fff7fe0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c0c7fff7ff0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0c0c7fff8000: fa fa fa fa 00 00 00 00 00 00 05 fa fa fa fa fa
0x0c0c7fff8010: 00 00 00 00 00 00 00 00 fa fa fa fa fd fd fd fd
0x0c0c7fff8020: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
=>0x0c0c7fff8030: fa fa fa fa 00 00 00 00 00 00 00 00[fa]fa fa fa
0x0c0c7fff8040: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
0x0c0c7fff8050: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
0x0c0c7fff8060: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff8070: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c0c7fff8080: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Signed-off-by: Marc-André Lureau <address@hidden>
Message-Id: <address@hidden>
---
tests/vhost-user-bridge.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tests/vhost-user-bridge.c b/tests/vhost-user-bridge.c
index 0884294..0cf8d0b 100644
--- a/tests/vhost-user-bridge.c
+++ b/tests/vhost-user-bridge.c
@@ -323,7 +323,7 @@ vubr_backend_recv_cb(int sock, void *ctx)
.msg_name = (struct sockaddr *) &vubr->backend_udp_dest,
.msg_namelen = sizeof(struct sockaddr_in),
.msg_iov = sg,
- .msg_iovlen = elem->in_num,
+ .msg_iovlen = num,
.msg_flags = MSG_DONTWAIT,
};
do {
--
1.8.3.1
- [Qemu-devel] [PULL 00/15] Misc patches for QEMU 3.1-rc3, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 01/15] target/i386: kvm: add VMX migration blocker, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 02/15] cpus: run work items for all vCPUs if single-threaded, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 03/15] lsi: Reselection needed to remove pending commands from queue, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 04/15] migration: savevm: consult migration blockers, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 06/15] vl: Improve error message when we can't load fw_cfg from file, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 08/15] vl.c: remove outdated comment, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 09/15] checkpatch: g_test_message does not need a trailing newline, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 10/15] target/i386: Generate #UD when applying LOCK to a register destination, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 07/15] vhost-user-bridge: fix recvmsg iovlen,
Paolo Bonzini <=
- [Qemu-devel] [PULL 11/15] MAINTAINERS: Add some missing entries related to accelerators, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 05/15] vmstate: constify VMStateField, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 12/15] MAINTAINERS: Add an entry for the Firmware Configuration (fw_cfg) device, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 13/15] configure: fix elf2dmp check, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 14/15] hostmem-memfd: honour share=on/off property, Paolo Bonzini, 2018/11/26
- [Qemu-devel] [PULL 15/15] hostmem: no need to check for host_memory_backend_mr_inited() in alloc(), Paolo Bonzini, 2018/11/26
- Re: [Qemu-devel] [PULL 00/15] Misc patches for QEMU 3.1-rc3, Peter Maydell, 2018/11/27