[Xen-changelog] [qemu-upstream-unstable] virtio-net: fix unmap leak

[patchbot@xxxxxxx]

commit 1ebb75b1fee779621b63e84fefa7b07354c43a99
Author:     Jason Wang <jasowang@xxxxxxxxxx>
AuthorDate: Thu Nov 27 18:04:03 2014 +0800
Commit:     Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
CommitDate: Tue Dec 2 10:41:02 2014 +0000

    virtio-net: fix unmap leak
    
    virtio_net_handle_ctrl() and other functions that process control vq
    request call iov_discard_front() which will shorten the iov. This will
    lead unmapping in virtqueue_push() leaks mapping.
    
    Fixes this by keeping the original iov untouched and using a temp variable
    in those functions.
    
    upstream-commit-id: 771b6ed37e3aa188a7485560b949a41c6cf174dc
    
    Cc: Wen Congyang <wency@xxxxxxxxxxxxxx>
    Cc: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
    Cc: qemu-stable@xxxxxxxxxx
    Signed-off-by: Jason Wang <jasowang@xxxxxxxxxx>
    Reviewed-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
    Reviewed-by: Fam Zheng <famz@xxxxxxxxxx>
    Reviewed-by: Michael S. Tsirkin <mst@xxxxxxxxxx>
    Message-id: 1417082643-23907-1-git-send-email-jasowang@xxxxxxxxxx
    Signed-off-by: Peter Maydell <peter.maydell@xxxxxxxxxx>
    Reviewed-Acked-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
---
 hw/net/virtio-net.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 2ac6ce5..d5e8ecb 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -772,7 +772,7 @@ static void virtio_net_handle_ctrl(VirtIODevice *vdev, 
VirtQueue *vq)
     virtio_net_ctrl_ack status = VIRTIO_NET_ERR;
     VirtQueueElement elem;
     size_t s;
-    struct iovec *iov;
+    struct iovec *iov, *iov2;
     unsigned int iov_cnt;
 
     while (virtqueue_pop(vq, &elem)) {
@@ -782,8 +782,8 @@ static void virtio_net_handle_ctrl(VirtIODevice *vdev, 
VirtQueue *vq)
             exit(1);
         }
 
-        iov = elem.out_sg;
         iov_cnt = elem.out_num;
+        iov2 = iov = g_memdup(elem.out_sg, sizeof(struct iovec) * 
elem.out_num);
         s = iov_to_buf(iov, iov_cnt, 0, &ctrl, sizeof(ctrl));
         iov_discard_front(&iov, &iov_cnt, sizeof(ctrl));
         if (s != sizeof(ctrl)) {
@@ -805,6 +805,7 @@ static void virtio_net_handle_ctrl(VirtIODevice *vdev, 
VirtQueue *vq)
 
         virtqueue_push(vq, &elem, sizeof(status));
         virtio_notify(vdev, vq);
+        g_free(iov2);
     }
 }
 
--
generated by git-patchbot for /home/xen/git/qemu-upstream-unstable.git

_______________________________________________
Xen-changelog mailing list
Xen-changelog@xxxxxxxxxxxxx
http://lists.xensource.com/xen-changelog