Commit ae440bd1 authored by Wei Wang's avatar Wei Wang Committed by Michael S. Tsirkin
Browse files

virtio-balloon: fix a use-after-free case 



The elem could theorically contain both outbuf and inbufs. We move the
free operation to the end of this function to avoid using elem->in_sg
while elem has been freed.

Fixes: c13c4153
("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
Reported-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: default avatarWei Wang <wei.w.wang@intel.com>
CC: Michael S. Tsirkin <mst@redhat.com>
CC: Dr. David Alan Gilbert <dgilbert@redhat.com>
CC: Juan Quintela <quintela@redhat.com>
CC: Peter Xu <peterx@redhat.com>
Message-Id: <1552383280-4122-1-git-send-email-wei.w.wang@intel.com>
Reviewed-by: default avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
parent 9d867123

hw/virtio/virtio-balloon.c

+7 −6
Original line number Diff line number Diff line
@@ -391,6 +391,7 @@ static bool get_free_page_hints(VirtIOBalloon *dev) 
    VirtQueueElement *elem;

    VirtIODevice *vdev = VIRTIO_DEVICE(dev);

    VirtQueue *vq = dev->free_page_vq;

    bool ret = true;



    while (dev->block_iothread) {

        qemu_cond_wait(&dev->free_page_cond, &dev->free_page_lock);
@@ -405,13 +406,12 @@ static bool get_free_page_hints(VirtIOBalloon *dev) 
        uint32_t id;

        size_t size = iov_to_buf(elem->out_sg, elem->out_num, 0,

                                 &id, sizeof(id));

        virtqueue_push(vq, elem, size);

        g_free(elem);



        virtio_tswap32s(vdev, &id);

        if (unlikely(size != sizeof(id))) {

            virtio_error(vdev, "received an incorrect cmd id");

            return false;

            ret = false;

            goto out;

        }

        if (id == dev->free_page_report_cmd_id) {

            dev->free_page_report_status = FREE_PAGE_REPORT_S_START;
@@ -431,11 +431,12 @@ static bool get_free_page_hints(VirtIOBalloon *dev) 
            qemu_guest_free_page_hint(elem->in_sg[0].iov_base,

                                      elem->in_sg[0].iov_len);

        }

        virtqueue_push(vq, elem, 1);

        g_free(elem);

    }



    return true;

out:

    virtqueue_push(vq, elem, 1);

    g_free(elem);

    return ret;

}



static void virtio_ballloon_get_free_page_hints(void *opaque)