Commits on Nov 1, 2023

1. virtio-net: fix use after unmap/free for sg …

   When mergeable buffer is enabled, we try to set the num_buffers after
   the virtqueue elem has been unmapped. This will lead several issues,
   E.g a use after free when the descriptor has an address which belongs
   to the non direct access region. In this case we use bounce buffer
   that is allocated during address_space_map() and freed during
   address_space_unmap().
   
   Fixing this by storing the elems temporarily in an array and delay the
   unmap after we set the the num_buffers.
   
   This addresses CVE-2021-3748.
   
   Reported-by: Alexander Bulekov <alxndr@bu.edu>
   Fixes: fbe78f4 ("virtio-net support")
   Cc: qemu-stable@nongnu.org
   Signed-off-by: Jason Wang <jasowang@redhat.com>

   

   jasowang authored and AndrewFasano committed Nov 1, 2023
   Configuration menu

   • View commit details
   • Copy full SHA for 0da6572
   • Browse repository at this point

   Copy the full SHA

   0da6572 View commit details

   Browse the repository at this point in the history