| Message ID | 20210630115246.2178219-1-marcel@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | pvrdma: Fix the ring init error flow (CVE-2021-3608) | expand |
On Wed, 30 Jun 2021 at 14:52, Marcel Apfelbaum <marcel.apfelbaum@gmail.com> wrote: > Do not unmap uninitialized dma addresses. > > Fixes: CVE-2021-3608 > Reviewed-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> > Tested-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> > Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> > --- > hw/rdma/vmw/pvrdma_dev_ring.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/rdma/vmw/pvrdma_dev_ring.c b/hw/rdma/vmw/pvrdma_dev_ring.c > index 074ac59b84..42130667a7 100644 > --- a/hw/rdma/vmw/pvrdma_dev_ring.c > +++ b/hw/rdma/vmw/pvrdma_dev_ring.c > @@ -41,7 +41,7 @@ int pvrdma_ring_init(PvrdmaRing *ring, const char *name, > PCIDevice *dev, > qatomic_set(&ring->ring_state->cons_head, 0); > */ > ring->npages = npages; > - ring->pages = g_malloc(npages * sizeof(void *)); > + ring->pages = g_malloc0(npages * sizeof(void *)); > > Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com> Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com> > for (i = 0; i < npages; i++) { > if (!tbl[i]) { > -- > 2.31.1 > >
On 6/30/21 1:52 PM, Marcel Apfelbaum wrote: > Do not unmap uninitialized dma addresses. > > Fixes: CVE-2021-3608 > Reviewed-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> > Tested-by: VictorV (Kunlun Lab) <vv474172261@gmail.com> > Signed-off-by: Marcel Apfelbaum <marcel@redhat.com> > --- > hw/rdma/vmw/pvrdma_dev_ring.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
diff --git a/hw/rdma/vmw/pvrdma_dev_ring.c b/hw/rdma/vmw/pvrdma_dev_ring.c index 074ac59b84..42130667a7 100644 --- a/hw/rdma/vmw/pvrdma_dev_ring.c +++ b/hw/rdma/vmw/pvrdma_dev_ring.c @@ -41,7 +41,7 @@ int pvrdma_ring_init(PvrdmaRing *ring, const char *name, PCIDevice *dev, qatomic_set(&ring->ring_state->cons_head, 0); */ ring->npages = npages; - ring->pages = g_malloc(npages * sizeof(void *)); + ring->pages = g_malloc0(npages * sizeof(void *)); for (i = 0; i < npages; i++) { if (!tbl[i]) {