[PATCH] virtio-net: fix map leaking on error during receive

[PATCH] virtio-net: fix map leaking on error during receive

[Jason Wang]

Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
tries to fix the use after free of the sg by caching the virtqueue
elements in an array and unmap them at once after receiving the
packets, But it forgot to unmap the cached elements on error which
will lead to leaking of mapping and other unexpected results.

Fixing this by detaching the cached elements on error. This addresses
CVE-2022-26353.

Reported-by: Victor Tom <vv474172261@gmail.com>
Cc: qemu-stable@nongnu.org
Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index cf8ab0f8af..65b61c836c 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1867,6 +1867,7 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
 
 err:
     for (j = 0; j < i; j++) {
+        virtqueue_detach_element(q->rx_vq, elems[j], lens[j]);
         g_free(elems[j]);
     }
 
-- 
2.25.1

Re: [PATCH] virtio-net: fix map leaking on error during receive

[Michael S. Tsirkin]

On Tue, Mar 08, 2022 at 01:56:42PM +0800, Jason Wang wrote:
> Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
> tries to fix the use after free of the sg by caching the virtqueue
> elements in an array and unmap them at once after receiving the
> packets, But it forgot to unmap the cached elements on error which
> will lead to leaking of mapping and other unexpected results.
> 
> Fixing this by detaching the cached elements on error. This addresses
> CVE-2022-26353.


Pls use a tag:

Fixes: CVE-2022-26353


Besides that

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Feel free to merge.

> Reported-by: Victor Tom <vv474172261@gmail.com>
> Cc: qemu-stable@nongnu.org
> Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
> Signed-off-by: Jason Wang <jasowang@redhat.com>

> ---
>  hw/net/virtio-net.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> index cf8ab0f8af..65b61c836c 100644
> --- a/hw/net/virtio-net.c
> +++ b/hw/net/virtio-net.c
> @@ -1867,6 +1867,7 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
>  
>  err:
>      for (j = 0; j < i; j++) {
> +        virtqueue_detach_element(q->rx_vq, elems[j], lens[j]);
>          g_free(elems[j]);
>      }
>  
> -- 
> 2.25.1

Re: [PATCH] virtio-net: fix map leaking on error during receive

[Jason Wang]

On Tue, Mar 8, 2022 at 2:56 PM Michael S. Tsirkin <mst@redhat.com> wrote:
>
> On Tue, Mar 08, 2022 at 01:56:42PM +0800, Jason Wang wrote:
> > Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
> > tries to fix the use after free of the sg by caching the virtqueue
> > elements in an array and unmap them at once after receiving the
> > packets, But it forgot to unmap the cached elements on error which
> > will lead to leaking of mapping and other unexpected results.
> >
> > Fixing this by detaching the cached elements on error. This addresses
> > CVE-2022-26353.
>
>
> Pls use a tag:
>
> Fixes: CVE-2022-26353

Will do.

>
>
> Besides that
>
> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
>
> Feel free to merge.

Ok.

Thanks

>
> > Reported-by: Victor Tom <vv474172261@gmail.com>
> > Cc: qemu-stable@nongnu.org
> > Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
> > Signed-off-by: Jason Wang <jasowang@redhat.com>
>
> > ---
> >  hw/net/virtio-net.c | 1 +
> >  1 file changed, 1 insertion(+)
> >
> > diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
> > index cf8ab0f8af..65b61c836c 100644
> > --- a/hw/net/virtio-net.c
> > +++ b/hw/net/virtio-net.c
> > @@ -1867,6 +1867,7 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
> >
> >  err:
> >      for (j = 0; j < i; j++) {
> > +        virtqueue_detach_element(q->rx_vq, elems[j], lens[j]);
> >          g_free(elems[j]);
> >      }
> >
> > --
> > 2.25.1
>