diff options
| author | Li Qiang <liq3ea@163.com> | 2021-05-15 20:04:00 -0700 |
|---|---|---|
| committer | Michael Roth <michael.roth@amd.com> | 2021-10-17 20:26:15 -0500 |
| commit | 4dda63d7edea4374dd3f5ec9982c255a6ec54d37 (patch) | |
| tree | 7f822bcced9655e505e93ddbe0331fc5d362dc0f | |
| parent | 457053998df9ab77fa82360bbe3115263063e17a (diff) | |
| download | qemu-4dda63d7edea4374dd3f5ec9982c255a6ec54d37.zip qemu-4dda63d7edea4374dd3f5ec9982c255a6ec54d37.tar.gz qemu-4dda63d7edea4374dd3f5ec9982c255a6ec54d37.tar.bz2 | |
vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544)
The 'res->iov' will be leaked if the guest trigger following sequences:
virgl_cmd_create_resource_2d
virgl_resource_attach_backing
virgl_cmd_resource_unref
This patch fixes this.
Fixes: CVE-2021-3544
Reported-by: Li Qiang <liq3ea@163.com>
virtio-gpu fix: 5e8e3c4c75 ("virtio-gpu: fix resource leak
in virgl_cmd_resource_unref"
Signed-off-by: Li Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-6-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
(cherry picked from commit f6091d86ba9ea05f4e111b9b42ee0005c37a6779)
Signed-off-by: Michael Roth <michael.roth@amd.com>
| -rw-r--r-- | contrib/vhost-user-gpu/virgl.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/contrib/vhost-user-gpu/virgl.c b/contrib/vhost-user-gpu/virgl.c index 6a332d6..c669d73 100644 --- a/contrib/vhost-user-gpu/virgl.c +++ b/contrib/vhost-user-gpu/virgl.c @@ -108,9 +108,16 @@ virgl_cmd_resource_unref(VuGpu *g, struct virtio_gpu_ctrl_command *cmd) { struct virtio_gpu_resource_unref unref; + struct iovec *res_iovs = NULL; + int num_iovs = 0; VUGPU_FILL_CMD(unref); + virgl_renderer_resource_detach_iov(unref.resource_id, + &res_iovs, + &num_iovs); + g_free(res_iovs); + virgl_renderer_resource_unref(unref.resource_id); } |