| Message ID | 20200327045620.9082-2-pannengyuan@huawei.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | fix two virtio queues memleak | expand |
On Fri, Mar 27, 2020 at 12:56:19PM +0800, Pan Nengyuan wrote: > virtio_vqs forgot to free on the error path in realize(). Fix that. > > The asan stack: > Direct leak of 14336 byte(s) in 1 object(s) allocated from: > #0 0x7f58b93fd970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970) > #1 0x7f58b858249d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d) > #2 0x5562cc627f49 in virtio_add_queue /mnt/sdb/qemu/hw/virtio/virtio.c:2413 > #3 0x5562cc4b524a in virtio_blk_device_realize /mnt/sdb/qemu/hw/block/virtio-blk.c:1202 > #4 0x5562cc613050 in virtio_device_realize /mnt/sdb/qemu/hw/virtio/virtio.c:3615 > #5 0x5562ccb7a568 in device_set_realized /mnt/sdb/qemu/hw/core/qdev.c:891 > #6 0x5562cd39cd45 in property_set_bool /mnt/sdb/qemu/qom/object.c:2238 > > Reported-by: Euler Robot <euler.robot@huawei.com> > Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> > --- > v2->v1: > - Fix incorrect free in v1, it will cause a uaf. > --- > Cc: Stefan Hajnoczi <stefanha@redhat.com> > Cc: Kevin Wolf <kwolf@redhat.com> > Cc: Max Reitz <mreitz@redhat.com> > Cc: qemu-block@nongnu.org > --- > hw/block/virtio-blk.c | 3 +++ > 1 file changed, 3 insertions(+) Reviewed-by: Stefano Garzarella <sgarzare@redhat.com> > > diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c > index 142863a3b2..97ba8a2187 100644 > --- a/hw/block/virtio-blk.c > +++ b/hw/block/virtio-blk.c > @@ -1204,6 +1204,9 @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp) > virtio_blk_data_plane_create(vdev, conf, &s->dataplane, &err); > if (err != NULL) { > error_propagate(errp, err); > + for (i = 0; i < conf->num_queues; i++) { > + virtio_del_queue(vdev, i); > + } > virtio_cleanup(vdev); > return; > } > -- > 2.18.2 > >
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c index 142863a3b2..97ba8a2187 100644 --- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -1204,6 +1204,9 @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp) virtio_blk_data_plane_create(vdev, conf, &s->dataplane, &err); if (err != NULL) { error_propagate(errp, err); + for (i = 0; i < conf->num_queues; i++) { + virtio_del_queue(vdev, i); + } virtio_cleanup(vdev); return; }
virtio_vqs forgot to free on the error path in realize(). Fix that. The asan stack: Direct leak of 14336 byte(s) in 1 object(s) allocated from: #0 0x7f58b93fd970 in __interceptor_calloc (/lib64/libasan.so.5+0xef970) #1 0x7f58b858249d in g_malloc0 (/lib64/libglib-2.0.so.0+0x5249d) #2 0x5562cc627f49 in virtio_add_queue /mnt/sdb/qemu/hw/virtio/virtio.c:2413 #3 0x5562cc4b524a in virtio_blk_device_realize /mnt/sdb/qemu/hw/block/virtio-blk.c:1202 #4 0x5562cc613050 in virtio_device_realize /mnt/sdb/qemu/hw/virtio/virtio.c:3615 #5 0x5562ccb7a568 in device_set_realized /mnt/sdb/qemu/hw/core/qdev.c:891 #6 0x5562cd39cd45 in property_set_bool /mnt/sdb/qemu/qom/object.c:2238 Reported-by: Euler Robot <euler.robot@huawei.com> Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com> --- v2->v1: - Fix incorrect free in v1, it will cause a uaf. --- Cc: Stefan Hajnoczi <stefanha@redhat.com> Cc: Kevin Wolf <kwolf@redhat.com> Cc: Max Reitz <mreitz@redhat.com> Cc: qemu-block@nongnu.org --- hw/block/virtio-blk.c | 3 +++ 1 file changed, 3 insertions(+)