Skip to content
Snippets Groups Projects
Select Git revision
  • feature/libtcg-rebase default protected
1 result
Search by author
  • Any Author
  • Anton Anton anjo
1 author
  1. Apr 20, 2022
  3. Apr 19, 2022
  5. Apr 12, 2022
  7. Apr 08, 2022
    • Wentao Liang's avatar
      virtio-iommu: use-after-free fix · 4bf58c72
      Wentao Liang authored 
      
A potential Use-after-free was reported in virtio_iommu_handle_command
when using virtio-iommu:

> I find a potential Use-after-free in QEMU 6.2.0, which is in
> virtio_iommu_handle_command() (./hw/virtio/virtio-iommu.c).
>
>
> Specifically, in the loop body, the variable 'buf' allocated at line 639 can be
> freed by g_free() at line 659. However, if the execution path enters the loop
> body again and the if branch takes true at line 616, the control will directly
> jump to 'out' at line 651. At this time, 'buf' is a freed pointer, which is not
> assigned with an allocated memory but used at line 653. As a result, a UAF bug
> is triggered.
>
>
>
> 599     for (;;) {
> ...
> 615         sz = iov_to_buf(iov, iov_cnt, 0, &head, sizeof(head));
> 616         if (unlikely(sz != sizeof(head))) {
> 617             tail.status = VIRTIO_IOMMU_S_DEVERR;
> 618             goto out;
> 619         }
> ...
> 639             buf = g_malloc0(output_size);
> ...
> 651 out:
> 652         sz = iov_from_buf(elem->in_sg, elem->in_num, 0,
> 653                           buf ? buf : &tail, output_size);
> ...
> 659         g_free(buf);
>
> We can fix it by set ‘buf‘ to NULL after freeing it:
>
>
> 651 out:
> 652         sz = iov_from_buf(elem->in_sg, elem->in_num, 0,
> 653                           buf ? buf : &tail, output_size);
> ...
> 659         g_free(buf);
> +++ buf = NULL;
> 660     }

Fix as suggested by the reporter.

Signed-off-by: default avatarWentao Liang <Wentao_Liang_g@163.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Message-id: 20220407095047.50371-1-mst@redhat.com
Message-ID: <20220406040445-mutt-send-email-mst@kernel.org>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      4bf58c72
    • Peter Maydell's avatar
      Merge tag 'fixes-20220408-pull-request' of git://git.kraxel.org/qemu into staging · dde8689d
      Peter Maydell authored 
      two cursor/qxl related security fixes.

# gpg: Signature made Fri 08 Apr 2022 05:37:16 BST
# gpg:                using RSA key A0328CFFB93A17A79901FE7D4CB6D8EED3E87138
# gpg: Good signature from "Gerd Hoffmann (work) <kraxel@redhat.com>" [full]
# gpg:                 aka "Gerd Hoffmann <gerd@kraxel.org>" [full]
# gpg:                 aka "Gerd Hoffmann (private) <kraxel@gmail.com>" [full]
# Primary key fingerprint: A032 8CFF B93A 17A7 9901  FE7D 4CB6 D8EE D3E8 7138

* tag 'fixes-20220408-pull-request' of git://git.kraxel.org/qemu

:
  ui/cursor: fix integer overflow in cursor_alloc (CVE-2021-4206)
  display/qxl-render: fix race condition in qxl_cursor (CVE-2021-4207)

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      dde8689d
  9. Apr 07, 2022
  11. Apr 06, 2022
  13. Apr 05, 2022
  15. Apr 04, 2022
  17. Apr 02, 2022
    • Peter Maydell's avatar
      Merge tag 'pull-request-2022-04-01' of https://gitlab.com/thuth/qemu into staging · bc6ec396
      Peter Maydell authored 
      * Fix some compilation issues
* Fix overflow calculation in s390x emulation
* Update location of lockdown.yml in MAINTAINERS file

# gpg: Signature made Fri 01 Apr 2022 12:27:38 BST
# gpg:                using RSA key 27B88847EEE0250118F3EAB92ED9D774FE702DB5
# gpg:                issuer "thuth@redhat.com"
# gpg: Good signature from "Thomas Huth <th.huth@gmx.de>" [full]
# gpg:                 aka "Thomas Huth <thuth@redhat.com>" [full]
# gpg:                 aka "Thomas Huth <huth@tuxfamily.org>" [full]
# gpg:                 aka "Thomas Huth <th.huth@posteo.de>" [unknown]
# Primary key fingerprint: 27B8 8847 EEE0 2501 18F3  EAB9 2ED9 D774 FE70 2DB5

* tag 'pull-request-2022-04-01' of https://gitlab.com/thuth/qemu

:
  trace: fix compilation with lttng-ust >= 2.13
  9p: move P9_XATTR_SIZE_MAX from 9p.h to 9p.c
  meson.build: Fix dependency of page-vary-common.c to config-poison.h
  target/s390x: Fix determination of overflow condition code after subtraction
  target/s390x: Fix determination of overflow condition code after addition
  misc: Fixes MAINTAINERS's path .github/workflows/lockdown.yml

Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
      bc6ec396
  19. Apr 01, 2022