Vulnerability: Memory leak in drivers/net/xen-netback/netback.c in the Xen netback functionality in the Linux kernel before 3.7.8 allows guest OS users to cause a denial of service (memory consumption) by triggering certain error conditions.
Vulnerability ID: CVE-2013-0217
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-02-18
File: drivers/net/xen-netback/netback.c
Commit message: xen/netback: don't leak pages on failure in xen_netbk_tx_check_gop.

Signed-off-by: Matthew Daley <mattjd@gmail.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Acked-by: Ian Campbell <ian.campbell@citrix.com>
Acked-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Matthew Daley

Vulnerable version (before fix):
 void xen_netbk_remove_xenvif(struct xenvif *vif) 	atomic_dec(&netbk->netfront_count); }  static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx); static void make_tx_response(struct xenvif *vif, 			     struct xen_netif_tx_request *txp, 			     s8       st); static int xen_netbk_tx_check_gop(struct xen_netbk *netbk, { 	struct gnttab_copy *gop = *gopp; 	u16 pending_idx = *((u16 *)skb->data); 	struct pending_tx_info *pending_tx_info = netbk->pending_tx_info; 	struct xenvif *vif = pending_tx_info[pending_idx].vif; 	struct xen_netif_tx_request *txp; 	struct skb_shared_info *shinfo = skb_shinfo(skb); 	int nr_frags = shinfo->nr_frags; 	int i, err, start;  	/* Check status of header. */ 	err = gop->status; 	if (unlikely(err)) { 		pending_ring_idx_t index; 		index = pending_index(netbk->pending_prod++); 		txp = &pending_tx_info[pending_idx].req; 		make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR); 		netbk->pending_ring[index] = pending_idx; 		xenvif_put(vif); 	}  	/* Skip first skb fragment if it is on same page as header fragment. */ 	start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);  	for (i = start; i < nr_frags; i++) { 		int j, newerr; 		pending_ring_idx_t index;  		pending_idx = frag_get_pending_idx(&shinfo->frags[i]);  static int xen_netbk_tx_check_gop(struct xen_netbk *netbk, 		if (likely(!newerr)) { 			/* Had a previous error? Invalidate this fragment. */ 			if (unlikely(err)) 				xen_netbk_idx_release(netbk, pending_idx); 			continue; 		}  		/* Error on this fragment: respond to client with an error. */ 		txp = &netbk->pending_tx_info[pending_idx].req; 		make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR); 		index = pending_index(netbk->pending_prod++); 		netbk->pending_ring[index] = pending_idx; 		xenvif_put(vif);  		/* Not the first error? Preceding frags already invalidated. */ 		if (err) 			continue;  		/* First error: invalidate header and preceding fragments. */ 		pending_idx = *((u16 *)skb->data); 		xen_netbk_idx_release(netbk, pending_idx); 		for (j = start; j < i; j++) { 			pending_idx = frag_get_pending_idx(&shinfo->frags[j]); 			xen_netbk_idx_release(netbk, pending_idx); 		}  		/* Remember the error: invalidate all subsequent fragments. */ static void xen_netbk_fill_frags(struct xen_netbk *netbk, struct sk_buff *skb)  		/* Take an extra reference to offset xen_netbk_idx_release */ 		get_page(netbk->mmap_pages[pending_idx]); 		xen_netbk_idx_release(netbk, pending_idx); 	} }  static void xen_netbk_tx_submit(struct xen_netbk *netbk) 			txp->size -= data_len; 		} else { 			/* Schedule a response immediately. */ 			xen_netbk_idx_release(netbk, pending_idx); 		}  		if (txp->flags & XEN_NETTXF_csum_blank) static void xen_netbk_tx_action(struct xen_netbk *netbk) 	xen_netbk_tx_submit(netbk); }  static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx) { 	struct xenvif *vif; 	struct pending_tx_info *pending_tx_info; static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)  	vif = pending_tx_info->vif;  	make_tx_response(vif, &pending_tx_info->req, XEN_NETIF_RSP_OKAY);  	index = pending_index(netbk->pending_prod++); 	netbk->pending_ring[index] = pending_idx;

Fixed version (after fix):
 void xen_netbk_remove_xenvif(struct xenvif *vif) 	atomic_dec(&netbk->netfront_count); }  static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx, 				  u8 status); static void make_tx_response(struct xenvif *vif, 			     struct xen_netif_tx_request *txp, 			     s8       st); static int xen_netbk_tx_check_gop(struct xen_netbk *netbk, { 	struct gnttab_copy *gop = *gopp; 	u16 pending_idx = *((u16 *)skb->data); 	struct skb_shared_info *shinfo = skb_shinfo(skb); 	int nr_frags = shinfo->nr_frags; 	int i, err, start;  	/* Check status of header. */ 	err = gop->status; 	if (unlikely(err)) 		xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);  	/* Skip first skb fragment if it is on same page as header fragment. */ 	start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);  	for (i = start; i < nr_frags; i++) { 		int j, newerr;  		pending_idx = frag_get_pending_idx(&shinfo->frags[i]);  static int xen_netbk_tx_check_gop(struct xen_netbk *netbk, 		if (likely(!newerr)) { 			/* Had a previous error? Invalidate this fragment. */ 			if (unlikely(err)) 				xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY); 			continue; 		}  		/* Error on this fragment: respond to client with an error. */ 		xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);  		/* Not the first error? Preceding frags already invalidated. */ 		if (err) 			continue;  		/* First error: invalidate header and preceding fragments. */ 		pending_idx = *((u16 *)skb->data); 		xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY); 		for (j = start; j < i; j++) { 			pending_idx = frag_get_pending_idx(&shinfo->frags[j]); 			xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY); 		}  		/* Remember the error: invalidate all subsequent fragments. */ static void xen_netbk_fill_frags(struct xen_netbk *netbk, struct sk_buff *skb)  		/* Take an extra reference to offset xen_netbk_idx_release */ 		get_page(netbk->mmap_pages[pending_idx]); 		xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY); 	} }  static void xen_netbk_tx_submit(struct xen_netbk *netbk) 			txp->size -= data_len; 		} else { 			/* Schedule a response immediately. */ 			xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY); 		}  		if (txp->flags & XEN_NETTXF_csum_blank) static void xen_netbk_tx_action(struct xen_netbk *netbk) 	xen_netbk_tx_submit(netbk); }  static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx, 				  u8 status) { 	struct xenvif *vif; 	struct pending_tx_info *pending_tx_info; static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)  	vif = pending_tx_info->vif;  	make_tx_response(vif, &pending_tx_info->req, status);  	index = pending_index(netbk->pending_prod++); 	netbk->pending_ring[index] = pending_idx;

Patch:
patch: @@ -147,7 +147,8 @@ void xen_netbk_remove_xenvif(struct xenvif *vif)
 	atomic_dec(&netbk->netfront_count);
 }
 
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx);
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+				  u8 status);
 static void make_tx_response(struct xenvif *vif,
 			     struct xen_netif_tx_request *txp,
 			     s8       st);
@@ -1007,30 +1008,20 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
 {
 	struct gnttab_copy *gop = *gopp;
 	u16 pending_idx = *((u16 *)skb->data);
-	struct pending_tx_info *pending_tx_info = netbk->pending_tx_info;
-	struct xenvif *vif = pending_tx_info[pending_idx].vif;
-	struct xen_netif_tx_request *txp;
 	struct skb_shared_info *shinfo = skb_shinfo(skb);
 	int nr_frags = shinfo->nr_frags;
 	int i, err, start;
 
 	/* Check status of header. */
 	err = gop->status;
-	if (unlikely(err)) {
-		pending_ring_idx_t index;
-		index = pending_index(netbk->pending_prod++);
-		txp = &pending_tx_info[pending_idx].req;
-		make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-		netbk->pending_ring[index] = pending_idx;
-		xenvif_put(vif);
-	}
+	if (unlikely(err))
+		xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
 
 	/* Skip first skb fragment if it is on same page as header fragment. */
 	start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
 
 	for (i = start; i < nr_frags; i++) {
 		int j, newerr;
-		pending_ring_idx_t index;
 
 		pending_idx = frag_get_pending_idx(&shinfo->frags[i]);
 
@@ -1039,27 +1030,23 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
 		if (likely(!newerr)) {
 			/* Had a previous error? Invalidate this fragment. */
 			if (unlikely(err))
-				xen_netbk_idx_release(netbk, pending_idx);
+				xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
 			continue;
 		}
 
 		/* Error on this fragment: respond to client with an error. */
-		txp = &netbk->pending_tx_info[pending_idx].req;
-		make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-		index = pending_index(netbk->pending_prod++);
-		netbk->pending_ring[index] = pending_idx;
-		xenvif_put(vif);
+		xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
 
 		/* Not the first error? Preceding frags already invalidated. */
 		if (err)
 			continue;
 
 		/* First error: invalidate header and preceding fragments. */
 		pending_idx = *((u16 *)skb->data);
-		xen_netbk_idx_release(netbk, pending_idx);
+		xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
 		for (j = start; j < i; j++) {
 			pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
-			xen_netbk_idx_release(netbk, pending_idx);
+			xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
 		}
 
 		/* Remember the error: invalidate all subsequent fragments. */
@@ -1093,7 +1080,7 @@ static void xen_netbk_fill_frags(struct xen_netbk *netbk, struct sk_buff *skb)
 
 		/* Take an extra reference to offset xen_netbk_idx_release */
 		get_page(netbk->mmap_pages[pending_idx]);
-		xen_netbk_idx_release(netbk, pending_idx);
+		xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
 	}
 }
 
@@ -1476,7 +1463,7 @@ static void xen_netbk_tx_submit(struct xen_netbk *netbk)
 			txp->size -= data_len;
 		} else {
 			/* Schedule a response immediately. */
-			xen_netbk_idx_release(netbk, pending_idx);
+			xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
 		}
 
 		if (txp->flags & XEN_NETTXF_csum_blank)
@@ -1528,7 +1515,8 @@ static void xen_netbk_tx_action(struct xen_netbk *netbk)
 	xen_netbk_tx_submit(netbk);
 }
 
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+				  u8 status)
 {
 	struct xenvif *vif;
 	struct pending_tx_info *pending_tx_info;
@@ -1542,7 +1530,7 @@ static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
 
 	vif = pending_tx_info->vif;
 
-	make_tx_response(vif, &pending_tx_info->req, XEN_NETIF_RSP_OKAY);
+	make_tx_response(vif, &pending_tx_info->req, status);
 
 	index = pending_index(netbk->pending_prod++);
 	netbk->pending_ring[index] = pending_idx;
path: drivers/net/xen-netback/netback.c