Commit abe300d9 authored by Jason Wang's avatar Jason Wang
Browse files

virtio-net: fix map leaking on error during receive

Commit bedd7e93

 ("virtio-net: fix use after unmap/free for sg")
tries to fix the use after free of the sg by caching the virtqueue
elements in an array and unmap them at once after receiving the
packets, But it forgot to unmap the cached elements on error which
will lead to leaking of mapping and other unexpected results.

Fixing this by detaching the cached elements on error. This addresses
CVE-2022-26353.

Reported-by: default avatarVictor Tom <vv474172261@gmail.com>
Cc: qemu-stable@nongnu.org
Fixes: CVE-2022-26353
Fixes: bedd7e93

 ("virtio-net: fix use after unmap/free for sg")
Reviewed-by: MST's avatarMichael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang's avatarJason Wang <jasowang@redhat.com>
parent 352998df
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment