xemu/block at 29647140157a4c91d4f80b8e8a633c6aabf579a6 - xemu

mirror of https://github.com/xemu-project/xemu.git synced 2025-03-06 19:47:11 +00:00

History

Stefan Hajnoczi 7bd04a041a virtio-blk: undo destructive iov_discard_*() operations

Fuzzing discovered that virtqueue_unmap_sg() is being called on modified
req->in/out_sg iovecs. This means dma_memory_map() and
dma_memory_unmap() calls do not have matching memory addresses.

Fuzzing discovered that non-RAM addresses trigger a bug:

  void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
                           bool is_write, hwaddr access_len)
  {
      if (buffer != bounce.buffer) {
          ^^^^^^^^^^^^^^^^^^^^^^^

A modified iov->iov_base is no longer recognized as a bounce buffer and
the wrong branch is taken.

There are more potential bugs: dirty memory is not tracked correctly and
MemoryRegion refcounts can be leaked.

Use the new iov_discard_undo() API to restore elem->in/out_sg before
virtqueue_push() is called.

Fixes: 827805a2492c1bbf1c0712ed18ee069b4ebf3dd6 ("virtio-blk: Convert VirtIOBlockReq.out to structrue")
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Buglink: https://bugs.launchpad.net/qemu/+bug/1890360
Message-Id: <20200917094455.822379-3-stefanha@redhat.com>

2020-09-23 13:41:58 +01:00

dataplane

meson: convert hw/block

2020-08-21 06:30:32 -04:00

block.c

block: make BlockConf size props 32bit and accept size suffixes

2020-06-17 14:53:40 +02:00

cdrom.c

Include qemu-common.h exactly where needed

2019-06-12 13:20:20 +02:00

ecc.c

Include hw/hw.h exactly where needed