| Message ID | 57e9f923.05acca0a.3dec3.0ccc@mx.google.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
Hi Greg, What about this patch? It seems you have forget it. 2016-09-27 12:44 GMT+08:00 Li Qiang <liq3ea@gmail.com>: > From: Li Qiang <liqiang6-s@360.cn> > > 9pfs uses g_malloc() to allocate the xattr memory space, if the guest > reads this memory before writing to it, this will leak host heap > memory to the guest. This patch avoid this. > > Signed-off-by: Li Qiang <liqiang6-s@360.cn> > --- > hw/9pfs/9p.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c > index b1ff8e7..4db1bd8 100644 > --- a/hw/9pfs/9p.c > +++ b/hw/9pfs/9p.c > @@ -3291,7 +3291,7 @@ static void v9fs_xattrcreate(void *opaque) > xattr_fidp->fs.xattr.flags = flags; > v9fs_string_init(&xattr_fidp->fs.xattr.name); > v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name); > - xattr_fidp->fs.xattr.value = g_malloc(size); > + xattr_fidp->fs.xattr.value = g_malloc0(size); > err = offset; > put_fid(pdu, file_fidp); > out_nofid: > -- > 1.8.3.1 > >
On Wed, 28 Sep 2016 14:42:05 +0800 Li Qiang <liq3ea@gmail.com> wrote: > Hi Greg, > > What about this patch? > > It seems you have forget it. > Heh not exactly... I'm just wondering why we allocate xattr_fidp->fs.xattr.value here if we don't use it. Can you please investigate if it is possible to defer allocation until it is really needed ? Thanks. -- Greg > 2016-09-27 12:44 GMT+08:00 Li Qiang <liq3ea@gmail.com>: > > > From: Li Qiang <liqiang6-s@360.cn> > > > > 9pfs uses g_malloc() to allocate the xattr memory space, if the guest > > reads this memory before writing to it, this will leak host heap > > memory to the guest. This patch avoid this. > > > > Signed-off-by: Li Qiang <liqiang6-s@360.cn> > > --- > > hw/9pfs/9p.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c > > index b1ff8e7..4db1bd8 100644 > > --- a/hw/9pfs/9p.c > > +++ b/hw/9pfs/9p.c > > @@ -3291,7 +3291,7 @@ static void v9fs_xattrcreate(void *opaque) > > xattr_fidp->fs.xattr.flags = flags; > > v9fs_string_init(&xattr_fidp->fs.xattr.name); > > v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name); > > - xattr_fidp->fs.xattr.value = g_malloc(size); > > + xattr_fidp->fs.xattr.value = g_malloc0(size); > > err = offset; > > put_fid(pdu, file_fidp); > > out_nofid: > > -- > > 1.8.3.1 > > > >
Yes, allocation here is also causing a memory leak issue. I will try to look more at it. On 2016-09-28 16:47 GMT+08:00 Greg Kurz <groug@kaod.org> wrote: > > > Heh not exactly... I'm just wondering why we allocate > xattr_fidp->fs.xattr.value > here if we don't use it. Can you please investigate if it is possible to > defer > allocation until it is really needed ? > > Thanks. > > -- > Greg > > > 2016-09-27 12:44 GMT+08:00 Li Qiang <liq3ea@gmail.com>: > > > > > From: Li Qiang <liqiang6-s@360.cn> > > > > > > 9pfs uses g_malloc() to allocate the xattr memory space, if the guest > > > reads this memory before writing to it, this will leak host heap > > > memory to the guest. This patch avoid this. > > > > > > Signed-off-by: Li Qiang <liqiang6-s@360.cn> > > > --- > > > hw/9pfs/9p.c | 2 +- > > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > > > diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c > > > index b1ff8e7..4db1bd8 100644 > > > --- a/hw/9pfs/9p.c > > > +++ b/hw/9pfs/9p.c > > > @@ -3291,7 +3291,7 @@ static void v9fs_xattrcreate(void *opaque) > > > xattr_fidp->fs.xattr.flags = flags; > > > v9fs_string_init(&xattr_fidp->fs.xattr.name); > > > v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name); > > > - xattr_fidp->fs.xattr.value = g_malloc(size); > > > + xattr_fidp->fs.xattr.value = g_malloc0(size); > > > err = offset; > > > put_fid(pdu, file_fidp); > > > out_nofid: > > > -- > > > 1.8.3.1 > > > > > > > >
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c index b1ff8e7..4db1bd8 100644 --- a/hw/9pfs/9p.c +++ b/hw/9pfs/9p.c @@ -3291,7 +3291,7 @@ static void v9fs_xattrcreate(void *opaque) xattr_fidp->fs.xattr.flags = flags; v9fs_string_init(&xattr_fidp->fs.xattr.name); v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name); - xattr_fidp->fs.xattr.value = g_malloc(size); + xattr_fidp->fs.xattr.value = g_malloc0(size); err = offset; put_fid(pdu, file_fidp); out_nofid: