Re: [Qemu-devel] [PATCH 1/2] 9pfs: fix information leak in xattr read

2016-10-13 Thread Greg Kurz
On Thu, 13 Oct 2016 11:30:08 +0800 Li Qiang wrote: > Yes, I think the limit to apply to xattr size in 9pfs is the same as the > Linux xattr size limit, I will try to find this limit. > /usr/include/linux/limits.h:#define XATTR_SIZE_MAX 65536/* size of an extended attribute value (64k)

Re: [Qemu-devel] [PATCH 1/2] 9pfs: fix information leak in xattr read

2016-10-13 Thread Greg Kurz
On Wed, 12 Oct 2016 15:49:46 -0500 Eric Blake wrote: > On 10/12/2016 08:23 AM, Greg Kurz wrote: > > > > But in fact, I'm afraid we have a more serious problem here... size > > comes from the guest and could cause g_malloc() to abort if QEMU has > > reached some RLIMIT... we need to call g_try_ma

Re: [Qemu-devel] [PATCH 1/2] 9pfs: fix information leak in xattr read

2016-10-12 Thread Li Qiang
Yes, I think the limit to apply to xattr size in 9pfs is the same as the Linux xattr size limit, I will try to find this limit. Thanks. On 2016-10-13 4:49 GMT+08:00 Eric Blake wrote: > On 10/12/2016 08:23 AM, Greg Kurz wrote: > > > > But in fact, I'm afraid we have a more serious problem here..

Re: [Qemu-devel] [PATCH 1/2] 9pfs: fix information leak in xattr read

2016-10-12 Thread Eric Blake
On 10/12/2016 08:23 AM, Greg Kurz wrote: > > But in fact, I'm afraid we have a more serious problem here... size > comes from the guest and could cause g_malloc() to abort if QEMU has > reached some RLIMIT... we need to call g_try_malloc0() and return > ENOMEM if the allocation fails. Even if it

Re: [Qemu-devel] [PATCH 1/2] 9pfs: fix information leak in xattr read

2016-10-12 Thread Greg Kurz
On Mon, 10 Oct 2016 10:56:03 +0200 Greg Kurz wrote: > On Sat, 8 Oct 2016 22:26:51 -0700 > Li Qiang wrote: > > > From: Li Qiang > > > > 9pfs uses g_malloc() to allocate the xattr memory space, if the guest > > reads this memory before writing to it, this will leak host heap memory > > to the

Re: [Qemu-devel] [PATCH 1/2] 9pfs: fix information leak in xattr read

2016-10-10 Thread Greg Kurz
On Sat, 8 Oct 2016 22:26:51 -0700 Li Qiang wrote: > From: Li Qiang > > 9pfs uses g_malloc() to allocate the xattr memory space, if the guest > reads this memory before writing to it, this will leak host heap memory > to the guest. This patch avoid this. > > Signed-off-by: Li Qiang > --- I'v

[Qemu-devel] [PATCH 1/2] 9pfs: fix information leak in xattr read

2016-10-08 Thread Li Qiang
From: Li Qiang 9pfs uses g_malloc() to allocate the xattr memory space, if the guest reads this memory before writing to it, this will leak host heap memory to the guest. This patch avoid this. Signed-off-by: Li Qiang --- hw/9pfs/9p.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff