Re: [PATCH 1/7] vhost-user-gpu: fix memory disclosure in virgl_cmd_get_capset_info

[Li Qiang]

P J P <ppandit@redhat.com> 于2021年5月5日周三 下午3:24写道：
>
> +-- On Tue, 4 May 2021, Li Qiang wrote --+
> | Otherwise some of the 'resp' will be leaked to guest.
> |
> | diff --git a/contrib/vhost-user-gpu/virgl.c b/contrib/vhost-user-gpu/virgl.c
> | index 9e6660c7ab..6a332d601f 100644
> |
> | +    memset(&resp, 0, sizeof(resp));
> |      if (info.capset_index == 0) {
> |          resp.capset_id = VIRTIO_GPU_CAPSET_VIRGL;
> |          virgl_renderer_get_cap_set(resp.capset_id,
>
> -   vg_ctrl_response(g, cmd, &resp.hdr, sizeof(resp));
> +   vg_ctrl_response(g, cmd, &resp.hdr, sizeof(resp.hdr));
>
> * While memset(3) is okay, should it also send header(hdr) size as 'resp_len'?
>

I don't think so. This function also set fields other than header such
as 'resp.capset_id', 'resp.capset_max_version' and so on.


Thanks,
Li Qiang

>
> Thank you.
> --
>  - P J P
> 8685 545E B54C 486B C6EB 271E E285 8B5A F050 DE8D
>