[Qemu-devel] [PULL 0/1] 9pfs patches for 2.11 20171016

[Qemu-devel] [PULL 0/1] 9pfs patches for 2.11 20171016

[Greg Kurz]

The following changes since commit 40a1e8ac2e10155b5df13a2508ac080b00cd7e23:

  Merge remote-tracking branch 'remotes/elmarco/tags/vu-pull-request' into staging (2017-10-16 10:22:39 +0100)

are available in the git repository at:

  https://github.com/gkurz/qemu.git tags/for-upstream

for you to fetch changes up to 7bd92756303f2158a68d5166264dc30139b813b6:

  9pfs: use g_malloc0 to allocate space for xattr (2017-10-16 14:21:59 +0200)

----------------------------------------------------------------
This fixes a potential data leak to the guest.

----------------------------------------------------------------
Prasad J Pandit (1):
      9pfs: use g_malloc0 to allocate space for xattr

 hw/9pfs/9p.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
-- 
2.13.6

[Qemu-devel] [PULL 1/1] 9pfs: use g_malloc0 to allocate space for xattr

[Greg Kurz]

From: Prasad J Pandit <pjp@fedoraproject.org>

9p back-end first queries the size of an extended attribute,
allocates space for it via g_malloc() and then retrieves its
value into allocated buffer. Race between querying attribute
size and retrieving its could lead to memory bytes disclosure.
Use g_malloc0() to avoid it.

Reported-by: Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Greg Kurz <groug@kaod.org>
---
 hw/9pfs/9p.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index 23ac7bb532f0..f8bbac251dc9 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -3234,7 +3234,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque)
         xattr_fidp->fid_type = P9_FID_XATTR;
         xattr_fidp->fs.xattr.xattrwalk_fid = true;
         if (size) {
-            xattr_fidp->fs.xattr.value = g_malloc(size);
+            xattr_fidp->fs.xattr.value = g_malloc0(size);
             err = v9fs_co_llistxattr(pdu, &xattr_fidp->path,
                                      xattr_fidp->fs.xattr.value,
                                      xattr_fidp->fs.xattr.len);
@@ -3267,7 +3267,7 @@ static void coroutine_fn v9fs_xattrwalk(void *opaque)
         xattr_fidp->fid_type = P9_FID_XATTR;
         xattr_fidp->fs.xattr.xattrwalk_fid = true;
         if (size) {
-            xattr_fidp->fs.xattr.value = g_malloc(size);
+            xattr_fidp->fs.xattr.value = g_malloc0(size);
             err = v9fs_co_lgetxattr(pdu, &xattr_fidp->path,
                                     &name, xattr_fidp->fs.xattr.value,
                                     xattr_fidp->fs.xattr.len);
-- 
2.13.6

Re: [Qemu-devel] [PULL 0/1] 9pfs patches for 2.11 20171016

[Peter Maydell]

On 16 October 2017 at 16:13, Greg Kurz <groug@kaod.org> wrote:
> The following changes since commit 40a1e8ac2e10155b5df13a2508ac080b00cd7e23:
>
>   Merge remote-tracking branch 'remotes/elmarco/tags/vu-pull-request' into staging (2017-10-16 10:22:39 +0100)
>
> are available in the git repository at:
>
>   https://github.com/gkurz/qemu.git tags/for-upstream
>
> for you to fetch changes up to 7bd92756303f2158a68d5166264dc30139b813b6:
>
>   9pfs: use g_malloc0 to allocate space for xattr (2017-10-16 14:21:59 +0200)
>
> ----------------------------------------------------------------
> This fixes a potential data leak to the guest.
>
> ----------------------------------------------------------------
> Prasad J Pandit (1):
>       9pfs: use g_malloc0 to allocate space for xattr

Applied, thanks.

-- PMM