Received: from eggs.gnu.org ([2001:4830:134:3::10]:47960) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XtuXv-0008TD-9s for qemu-devel@nongnu.org; Thu, 27 Nov 2014 03:35:31 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XtuXq-00020o-Jt for qemu-devel@nongnu.org; Thu, 27 Nov 2014 03:35:27 -0500 Date: Thu, 27 Nov 2014 08:43:03 +0008 From: Jason Wang Message-Id: <1417077303.18179.0@smtp.corp.redhat.com> In-Reply-To: <20141127074545.GA29360@fam-t430.nay.redhat.com> References: <1417067965-9159-1-git-send-email-jasowang@redhat.com> <20141127074545.GA29360@fam-t430.nay.redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Subject: Re: [Qemu-devel] [Qemu-stable] [2.2 PATCH] virtio-net: fix unmap leak List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Fam Zheng Cc: mst@redhat.com, qemu-stable@nongnu.org, aliguori@amazon.com, qemu-devel@nongnu.org On Thu, Nov 27, 2014 at 3:45 PM, Fam Zheng wrote: > On Thu, 11/27 13:59, Jason Wang wrote: >> virtio_net_handle_ctrl() and other functions that process control vq >> request call iov_discard_front() which will shorten the iov. This >> will >> lead unmapping in virtqueue_push() leaks mapping. >> >> Fixes this by keeping the original iov untouched and using a temp >> variable >> in those functions. > > I'm a little confused. Commit message mentioned "other functions" but > in this > patch only virtio_net_handle_ctrl is changed. So is this complete? > > Fam It's ok since all other functions were called by vitio_net_handle_ctrl() and it pass temp variable to those specific helpers to handle ctrl vq commands. > > >> >> Cc: Wen Congyang >> Cc: Stefano Stabellini >> Cc: qemu-stable@nongnu.org >> Signed-off-by: Jason Wang >> --- >> hw/net/virtio-net.c | 9 +++++++-- >> 1 file changed, 7 insertions(+), 2 deletions(-) >> >> diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c >> index 9b88775..fdb4edd 100644 >> --- a/hw/net/virtio-net.c >> +++ b/hw/net/virtio-net.c >> @@ -798,7 +798,7 @@ static void virtio_net_handle_ctrl(VirtIODevice >> *vdev, VirtQueue *vq) >> virtio_net_ctrl_ack status = VIRTIO_NET_ERR; >> VirtQueueElement elem; >> size_t s; >> - struct iovec *iov; >> + struct iovec *iov, *iov2; >> unsigned int iov_cnt; >> >> while (virtqueue_pop(vq, &elem)) { >> @@ -808,8 +808,12 @@ static void >> virtio_net_handle_ctrl(VirtIODevice *vdev, VirtQueue *vq) >> exit(1); >> } >> >> - iov = elem.out_sg; >> iov_cnt = elem.out_num; >> + s = sizeof(struct iovec) * elem.out_num; >> + iov = g_malloc(s); >> + memcpy(iov, elem.out_sg, s); >> + iov2 = iov; >> + >> s = iov_to_buf(iov, iov_cnt, 0, &ctrl, sizeof(ctrl)); >> iov_discard_front(&iov, &iov_cnt, sizeof(ctrl)); >> if (s != sizeof(ctrl)) { >> @@ -833,6 +837,7 @@ static void virtio_net_handle_ctrl(VirtIODevice >> *vdev, VirtQueue *vq) >> >> virtqueue_push(vq, &elem, sizeof(status)); >> virtio_notify(vdev, vq); >> + g_free(iov2); >> } >> } >> >> -- >> 1.9.1 >> >> >