From ba9806fd38f113deb452156fdc644407f061311c Mon Sep 17 00:00:00 2001
From: Jason Wang <jasowang@redhat.com>
Date: Tue, 8 Mar 2022 10:42:51 +0800
Subject: [PATCH 06/11] virtio-net: fix map leaking on error during receive
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

RH-Author: Jon Maloy <jmaloy@redhat.com>
RH-MergeRequest: 165: virtio-net: fix map leaking on error during receive
RH-Commit: [1/1] f0546c74a5bfd37de473703f6a7c6f8f29fb0831 (jmaloy/qemu-kvm)
RH-Bugzilla: 2075637
RH-Acked-by: Mauro Matteo Cascella <None>
RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
RH-Acked-by: Gerd Hoffmann <kraxel@redhat.com>

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2075637
Upstream: Merged
CVE: CVE-2022-26353

commit abe300d9d894f7138e1af7c8e9c88c04bfe98b37
Author: Jason Wang <jasowang@redhat.com>
Date:   Tue Mar 8 10:42:51 2022 +0800

    virtio-net: fix map leaking on error during receive

    Commit bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
    tries to fix the use after free of the sg by caching the virtqueue
    elements in an array and unmap them at once after receiving the
    packets, But it forgot to unmap the cached elements on error which
    will lead to leaking of mapping and other unexpected results.

    Fixing this by detaching the cached elements on error. This addresses
    CVE-2022-26353.

    Reported-by: Victor Tom <vv474172261@gmail.com>
    Cc: qemu-stable@nongnu.org
    Fixes: CVE-2022-26353
    Fixes: bedd7e93d0196 ("virtio-net: fix use after unmap/free for sg")
    Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
    Signed-off-by: Jason Wang <jasowang@redhat.com>

(cherry picked from commit abe300d9d894f7138e1af7c8e9c88c04bfe98b37)
Signed-off-by: Jon Maloy <jmaloy@redhat.com>
---
 hw/net/virtio-net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index f2014d5ea0..e1f4748831 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1862,6 +1862,7 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
 
 err:
     for (j = 0; j < i; j++) {
+        virtqueue_detach_element(q->rx_vq, elems[j], lens[j]);
         g_free(elems[j]);
     }
 
-- 
2.27.0