diff options
| author | Li Qiang <liq3ea@163.com> | 2021-05-15 20:04:00 -0700 |
|---|---|---|
| committer | Gerd Hoffmann <kraxel@redhat.com> | 2021-05-27 11:55:59 +0200 |
| commit | f6091d86ba9ea05f4e111b9b42ee0005c37a6779 (patch) | |
| tree | 0432cf2277b8ea0c65215c277d72042438523259 | |
| parent | b7afebcf9e6ecf3cf9b5a9b9b731ed04bca6aa3e (diff) | |
| download | qemu-f6091d86ba9ea05f4e111b9b42ee0005c37a6779.zip qemu-f6091d86ba9ea05f4e111b9b42ee0005c37a6779.tar.gz qemu-f6091d86ba9ea05f4e111b9b42ee0005c37a6779.tar.bz2 | |
vhost-user-gpu: fix memory leak in 'virgl_cmd_resource_unref' (CVE-2021-3544)
The 'res->iov' will be leaked if the guest trigger following sequences:
virgl_cmd_create_resource_2d
virgl_resource_attach_backing
virgl_cmd_resource_unref
This patch fixes this.
Fixes: CVE-2021-3544
Reported-by: Li Qiang <liq3ea@163.com>
virtio-gpu fix: 5e8e3c4c75 ("virtio-gpu: fix resource leak
in virgl_cmd_resource_unref"
Signed-off-by: Li Qiang <liq3ea@163.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20210516030403.107723-6-liq3ea@163.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
| -rw-r--r-- | contrib/vhost-user-gpu/virgl.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/contrib/vhost-user-gpu/virgl.c b/contrib/vhost-user-gpu/virgl.c index 6a332d6..c669d73 100644 --- a/contrib/vhost-user-gpu/virgl.c +++ b/contrib/vhost-user-gpu/virgl.c @@ -108,9 +108,16 @@ virgl_cmd_resource_unref(VuGpu *g, struct virtio_gpu_ctrl_command *cmd) { struct virtio_gpu_resource_unref unref; + struct iovec *res_iovs = NULL; + int num_iovs = 0; VUGPU_FILL_CMD(unref); + virgl_renderer_resource_detach_iov(unref.resource_id, + &res_iovs, + &num_iovs); + g_free(res_iovs); + virgl_renderer_resource_unref(unref.resource_id); } |