From patchwork Fri Feb 8 15:19:01 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Luis Henriques X-Patchwork-Id: 219201 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id D4EE32C0092 for ; Sat, 9 Feb 2013 02:19:27 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1U3pjQ-0003yp-L0; Fri, 08 Feb 2013 15:19:16 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1U3pjM-0003xf-V4 for kernel-team@lists.ubuntu.com; Fri, 08 Feb 2013 15:19:13 +0000 Received: from bl22-241-30.dsl.telepac.pt ([2.83.241.30] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1U3pjM-0005Kh-Ox for kernel-team@lists.ubuntu.com; Fri, 08 Feb 2013 15:19:12 +0000 From: Luis Henriques To: kernel-team@lists.ubuntu.com Subject: [Quantal CVE 2/2] UBUNTU: SAUCE: xen/netback: free already allocated memory on failure in xen_netbk_get_requests Date: Fri, 8 Feb 2013 15:19:01 +0000 Message-Id: <1360336743-5290-7-git-send-email-luis.henriques@canonical.com> X-Mailer: git-send-email 1.8.1.2 In-Reply-To: <1360336743-5290-1-git-send-email-luis.henriques@canonical.com> References: <1360336743-5290-1-git-send-email-luis.henriques@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Ian Campbell BugLink: http://bugs.launchpad.net/bugs/1117331 Signed-off-by: Ian Campbell CVE-2013-0217 Signed-off-by: Stefan Bader Acked-by: Luis Henriques --- drivers/net/xen-netback/netback.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c index d0a52b9..9a5189e 100644 --- a/drivers/net/xen-netback/netback.c +++ b/drivers/net/xen-netback/netback.c @@ -949,7 +949,7 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk, pending_idx = netbk->pending_ring[index]; page = xen_netbk_alloc_page(netbk, skb, pending_idx); if (!page) - return NULL; + goto err; gop->source.u.ref = txp->gref; gop->source.domid = vif->domid; @@ -971,6 +971,20 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk, } return gop; +err: + /* + * Unwind, freeing all pages and sending error + * reponses. + */ + while (i-- > start) { + xen_netbk_idx_release(netbk, frag_get_pending_idx(&frags[i]), + XEN_NETIF_RSP_ERROR); + } + /* The head too, if necessary. */ + if (start) + xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR); + + return NULL; } static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,