From d1a64781c4f7fa698a359ea078a98029f4f67c1b Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Tue, 8 Mar 2022 10:42:51 +0800 Subject: [PATCH 2/3] virtio-net: fix map leaking on error during receive RH-Author: Jon Maloy RH-MergeRequest: 178: virtio-net: fix map leaking on error during receive RH-Commit: [1/1] afdfa3198fcf815de59915136222f73711efd292 (jmaloy/qemu-kvm) RH-Bugzilla: 2075635 RH-Acked-by: Jason Wang RH-Acked-by: Miroslav Rezanina RH-Acked-by: Kevin Wolf RH-Acked-by: Laurent Vivier Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2075635 Upstream: Merged CVE: CVE-2022-26353 commit abe300d9d894f7138e1af7c8e9c88c04bfe98b37 Author: Jason Wang Date: Tue Mar 8 10:42:51 2022 +0800 virtio-net: fix map leaking on error during receive Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg") tries to fix the use after free of the sg by caching the virtqueue elements in an array and unmap them at once after receiving the packets, But it forgot to unmap the cached elements on error which will lead to leaking of mapping and other unexpected results. Fixing this by detaching the cached elements on error. This addresses CVE-2022-26353. Reported-by: Victor Tom Cc: qemu-stable@nongnu.org Fixes: CVE-2022-26353 Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg") Reviewed-by: Michael S. Tsirkin Signed-off-by: Jason Wang (cherry picked from commit abe300d9d894f7138e1af7c8e9c88c04bfe98b37) Signed-off-by: Jon Maloy --- hw/net/virtio-net.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c index f2014d5ea0..e1f4748831 100644 --- a/hw/net/virtio-net.c +++ b/hw/net/virtio-net.c @@ -1862,6 +1862,7 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf, err: for (j = 0; j < i; j++) { + virtqueue_detach_element(q->rx_vq, elems[j], lens[j]); g_free(elems[j]); } -- 2.31.1