* [PATCH] hw/virtio/virtio-iommu: Reject inverted MAP range
@ 2026-08-03 9:43 Bin Guo
2026-08-03 10:25 ` Michael S. Tsirkin
0 siblings, 1 reply; 2+ messages in thread
From: Bin Guo @ 2026-08-03 9:43 UTC (permalink / raw)
To: qemu-devel; +Cc: Eric Auger, Michael S . Tsirkin, qemu-stable
virtio_iommu_map() did not check that virt_end >= virt_start. An
inverted range corrupts the GTree comparator contract (interval_cmp
returns non-zero for a key compared with itself), causing an infinite
loop in virtio_iommu_unmap() while holding s->mutex.
Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4104
Cc: qemu-stable@nongnu.org
Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
---
hw/virtio/virtio-iommu.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 533bd5073f..cc863e90d2 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -807,6 +807,10 @@ static int virtio_iommu_map(VirtIOIOMMU *s,
return VIRTIO_IOMMU_S_INVAL;
}
+ if (virt_end < virt_start) {
+ return VIRTIO_IOMMU_S_INVAL;
+ }
+
domain = g_tree_lookup(s->domains, GUINT_TO_POINTER(domain_id));
if (!domain) {
return VIRTIO_IOMMU_S_NOENT;
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] hw/virtio/virtio-iommu: Reject inverted MAP range
2026-08-03 9:43 [PATCH] hw/virtio/virtio-iommu: Reject inverted MAP range Bin Guo
@ 2026-08-03 10:25 ` Michael S. Tsirkin
0 siblings, 0 replies; 2+ messages in thread
From: Michael S. Tsirkin @ 2026-08-03 10:25 UTC (permalink / raw)
To: Bin Guo; +Cc: qemu-devel, Eric Auger, qemu-stable
On Mon, Aug 03, 2026 at 05:43:02PM +0800, Bin Guo wrote:
> virtio_iommu_map() did not check that virt_end >= virt_start. An
> inverted range corrupts the GTree comparator contract (interval_cmp
> returns non-zero for a key compared with itself), causing an infinite
> loop in virtio_iommu_unmap() while holding s->mutex.
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4104
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
Same as 20260729131953.1720567-1-physicalmtea@gmail.com ?
> ---
> hw/virtio/virtio-iommu.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
> index 533bd5073f..cc863e90d2 100644
> --- a/hw/virtio/virtio-iommu.c
> +++ b/hw/virtio/virtio-iommu.c
> @@ -807,6 +807,10 @@ static int virtio_iommu_map(VirtIOIOMMU *s,
> return VIRTIO_IOMMU_S_INVAL;
> }
>
> + if (virt_end < virt_start) {
> + return VIRTIO_IOMMU_S_INVAL;
> + }
> +
> domain = g_tree_lookup(s->domains, GUINT_TO_POINTER(domain_id));
> if (!domain) {
> return VIRTIO_IOMMU_S_NOENT;
> --
> 2.50.1 (Apple Git-155)
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-03 10:26 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-03 9:43 [PATCH] hw/virtio/virtio-iommu: Reject inverted MAP range Bin Guo
2026-08-03 10:25 ` Michael S. Tsirkin
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.