[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH 65/88] virtio-net: fix unmap leak
From: |
Michael Roth |
Subject: |
[Qemu-devel] [PATCH 65/88] virtio-net: fix unmap leak |
Date: |
Thu, 8 Jan 2015 11:34:09 -0600 |
From: Jason Wang <address@hidden>
virtio_net_handle_ctrl() and other functions that process control vq
request call iov_discard_front() which will shorten the iov. This will
lead unmapping in virtqueue_push() leaks mapping.
Fixes this by keeping the original iov untouched and using a temp variable
in those functions.
Cc: Wen Congyang <address@hidden>
Cc: Stefano Stabellini <address@hidden>
Cc: address@hidden
Signed-off-by: Jason Wang <address@hidden>
Reviewed-by: Stefano Stabellini <address@hidden>
Reviewed-by: Fam Zheng <address@hidden>
Reviewed-by: Michael S. Tsirkin <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>
(cherry picked from commit 771b6ed37e3aa188a7485560b949a41c6cf174dc)
Signed-off-by: Michael Roth <address@hidden>
---
hw/net/virtio-net.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 2040eac..6360374 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -798,7 +798,7 @@ static void virtio_net_handle_ctrl(VirtIODevice *vdev,
VirtQueue *vq)
virtio_net_ctrl_ack status = VIRTIO_NET_ERR;
VirtQueueElement elem;
size_t s;
- struct iovec *iov;
+ struct iovec *iov, *iov2;
unsigned int iov_cnt;
while (virtqueue_pop(vq, &elem)) {
@@ -808,8 +808,8 @@ static void virtio_net_handle_ctrl(VirtIODevice *vdev,
VirtQueue *vq)
exit(1);
}
- iov = elem.out_sg;
iov_cnt = elem.out_num;
+ iov2 = iov = g_memdup(elem.out_sg, sizeof(struct iovec) *
elem.out_num);
s = iov_to_buf(iov, iov_cnt, 0, &ctrl, sizeof(ctrl));
iov_discard_front(&iov, &iov_cnt, sizeof(ctrl));
if (s != sizeof(ctrl)) {
@@ -833,6 +833,7 @@ static void virtio_net_handle_ctrl(VirtIODevice *vdev,
VirtQueue *vq)
virtqueue_push(vq, &elem, sizeof(status));
virtio_notify(vdev, vq);
+ g_free(iov2);
}
}
--
1.9.1
- [Qemu-devel] [PATCH 23/88] ivshmem: Fix potential OOB r/w access, (continued)
- [Qemu-devel] [PATCH 23/88] ivshmem: Fix potential OOB r/w access, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 55/88] snapshot: add bdrv_drain_all() to bdrv_snapshot_delete() to avoid concurrency problem, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 61/88] libcacard: fix resource leak, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 59/88] kvm: Fix memory slot page alignment logic, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 62/88] l2tpv3: fix possible double free, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 60/88] virtio-scsi: work around bug in old BIOSes, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 64/88] hw/ide/core.c: Prevent SIGSEGV during migration, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 66/88] block: Make essential BlockDriver objects public, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 63/88] exec: Handle multipage ranges in invalidate_and_set_dirty(), Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 67/88] block: Omit bdrv_find_format for essential drivers, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 65/88] virtio-net: fix unmap leak,
Michael Roth <=
- [Qemu-devel] [PATCH 68/88] block/vvfat: qcow driver may not be found, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 70/88] block: Check create_opts before image creation, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 73/88] iotests: Only kill NBD server if it runs, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 69/88] block/nfs: Add create_opts, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 79/88] block migration: fix return value, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 71/88] qemu-img: Check create_opts before image creation, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 72/88] qemu-img: Check create_opts before image amendment, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 74/88] iotests: Add test for unsupported image creation, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 77/88] qcow2: Respect bdrv_truncate() error, Michael Roth, 2015/01/08
- [Qemu-devel] [PATCH 80/88] qcow2: Fix header extension size check, Michael Roth, 2015/01/08