From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47549) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1btWNa-0005WX-R4 for qemu-devel@nongnu.org; Mon, 10 Oct 2016 04:56:15 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1btWNW-0002EL-Jp for qemu-devel@nongnu.org; Mon, 10 Oct 2016 04:56:13 -0400 Received: from 16.mo6.mail-out.ovh.net ([87.98.139.208]:46023) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1btWNW-0002D8-DU for qemu-devel@nongnu.org; Mon, 10 Oct 2016 04:56:10 -0400 Received: from player738.ha.ovh.net (b7.ovh.net [213.186.33.57]) by mo6.mail-out.ovh.net (Postfix) with ESMTP id 79F093CBBB for ; Mon, 10 Oct 2016 10:56:07 +0200 (CEST) Date: Mon, 10 Oct 2016 10:56:03 +0200 From: Greg Kurz Message-ID: <20161010105603.132a5d53@bahia> In-Reply-To: <6aefc5ee17ba6ac636de56bba8e7f24fd0262187.1475990063.git.liqiang6-s@360.cn> References: <6aefc5ee17ba6ac636de56bba8e7f24fd0262187.1475990063.git.liqiang6-s@360.cn> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 1/2] 9pfs: fix information leak in xattr read List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Li Qiang Cc: qemu-devel@nongnu.org, Li Qiang On Sat, 8 Oct 2016 22:26:51 -0700 Li Qiang wrote: > From: Li Qiang > > 9pfs uses g_malloc() to allocate the xattr memory space, if the guest > reads this memory before writing to it, this will leak host heap memory > to the guest. This patch avoid this. > > Signed-off-by: Li Qiang > --- I've looked again and we could theorically defer allocation until v9fs_xattr_write() is called, and only allow v9fs_xattr_read() to return bytes previously written by the client. But this would result in rather complex code to handle partial writes and reads. So this patch looks like the way to go. Reviewed-by: Greg Kurz > hw/9pfs/9p.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c > index 119ee58..8751c19 100644 > --- a/hw/9pfs/9p.c > +++ b/hw/9pfs/9p.c > @@ -3282,7 +3282,7 @@ static void v9fs_xattrcreate(void *opaque) > xattr_fidp->fs.xattr.flags = flags; > v9fs_string_init(&xattr_fidp->fs.xattr.name); > v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name); > - xattr_fidp->fs.xattr.value = g_malloc(size); > + xattr_fidp->fs.xattr.value = g_malloc0(size); > err = offset; > put_fid(pdu, file_fidp); > out_nofid: