If the guest trigger following sequences, the attach_backing will be leaked:
vg_resource_create_2d
vg_resource_attach_backing
vg_resource_unref
This patch fix this by freeing 'res->iov' in vg_resource_destroy.
Fixes: CVE-2021-3544
Reported-by: Li Qiang <liq3ea@163.com>
virtio-gpu fix:
|
||
|---|---|---|
| .. | ||
| elf2dmp | ||
| gitdm | ||
| ivshmem-client | ||
| ivshmem-server | ||
| plugins | ||
| rdmacm-mux | ||
| systemd | ||
| vhost-user-blk | ||
| vhost-user-gpu | ||
| vhost-user-input | ||
| vhost-user-scsi | ||