* [PATCH] hw/virtio/virtio-pci: add defensive check for vector_irqfd
@ 2025-08-14 11:08 gerben
2025-08-14 11:47 ` Philippe Mathieu-Daudé
2025-08-14 13:07 ` Michael S. Tsirkin
0 siblings, 2 replies; 3+ messages in thread
From: gerben @ 2025-08-14 11:08 UTC (permalink / raw)
To: qemu-devel, mst; +Cc: sdl.qemu
From: Denis Rastyogin <gerben@altlinux.org>
Add a NULL check for proxy->vector_irqfd in
virtio_pci_one_vector_unmask() before taking the irqfd path.
This prevents potential access to uninitialized state if
vector_irqfd is absent.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Reported-by: Alexey Appolonov <alexey@altlinux.org>
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
---
hw/virtio/virtio-pci.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 767216d795..07904f6f9b 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -1015,7 +1015,11 @@ static int virtio_pci_one_vector_unmask(VirtIOPCIProxy *proxy,
event_notifier_set(n);
}
} else {
- ret = kvm_virtio_pci_irqfd_use(proxy, n, vector);
+ if (proxy->vector_irqfd) {
+ ret = kvm_virtio_pci_irqfd_use(proxy, n, vector);
+ } else {
+ ret = -EFAULT;
+ }
}
return ret;
}
--
2.42.2
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] hw/virtio/virtio-pci: add defensive check for vector_irqfd
2025-08-14 11:08 [PATCH] hw/virtio/virtio-pci: add defensive check for vector_irqfd gerben
@ 2025-08-14 11:47 ` Philippe Mathieu-Daudé
2025-08-14 13:07 ` Michael S. Tsirkin
1 sibling, 0 replies; 3+ messages in thread
From: Philippe Mathieu-Daudé @ 2025-08-14 11:47 UTC (permalink / raw)
To: gerben, qemu-devel, mst; +Cc: sdl.qemu
Hi Denis,
On 14/8/25 13:08, gerben@altlinux.org wrote:
> From: Denis Rastyogin <gerben@altlinux.org>
>
> Add a NULL check for proxy->vector_irqfd in
> virtio_pci_one_vector_unmask() before taking the irqfd path.
> This prevents potential access to uninitialized state if
> vector_irqfd is absent.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Reported-by: Alexey Appolonov <alexey@altlinux.org>
> Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
> ---
> hw/virtio/virtio-pci.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
> index 767216d795..07904f6f9b 100644
> --- a/hw/virtio/virtio-pci.c
> +++ b/hw/virtio/virtio-pci.c
> @@ -1015,7 +1015,11 @@ static int virtio_pci_one_vector_unmask(VirtIOPCIProxy *proxy,
> event_notifier_set(n);
> }
> } else {
> - ret = kvm_virtio_pci_irqfd_use(proxy, n, vector);
> + if (proxy->vector_irqfd) {
Why check the callers and not once in the callee?
> + ret = kvm_virtio_pci_irqfd_use(proxy, n, vector);
> + } else {
> + ret = -EFAULT;
> + }
> }
> return ret;
> }
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] hw/virtio/virtio-pci: add defensive check for vector_irqfd
2025-08-14 11:08 [PATCH] hw/virtio/virtio-pci: add defensive check for vector_irqfd gerben
2025-08-14 11:47 ` Philippe Mathieu-Daudé
@ 2025-08-14 13:07 ` Michael S. Tsirkin
1 sibling, 0 replies; 3+ messages in thread
From: Michael S. Tsirkin @ 2025-08-14 13:07 UTC (permalink / raw)
To: gerben; +Cc: qemu-devel, sdl.qemu
On Thu, Aug 14, 2025 at 02:08:08PM +0300, gerben@altlinux.org wrote:
> From: Denis Rastyogin <gerben@altlinux.org>
>
> Add a NULL check for proxy->vector_irqfd in
> virtio_pci_one_vector_unmask() before taking the irqfd path.
> This prevents potential access to uninitialized state if
> vector_irqfd is absent.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> Reported-by: Alexey Appolonov <alexey@altlinux.org>
> Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
I don't really understand what this description means. defensive against
what? found in what sense? what is the uninitialized state accessed?
when is the potential for this access?
> ---
> hw/virtio/virtio-pci.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
> index 767216d795..07904f6f9b 100644
> --- a/hw/virtio/virtio-pci.c
> +++ b/hw/virtio/virtio-pci.c
> @@ -1015,7 +1015,11 @@ static int virtio_pci_one_vector_unmask(VirtIOPCIProxy *proxy,
> event_notifier_set(n);
> }
> } else {
> - ret = kvm_virtio_pci_irqfd_use(proxy, n, vector);
> + if (proxy->vector_irqfd) {
> + ret = kvm_virtio_pci_irqfd_use(proxy, n, vector);
> + } else {
> + ret = -EFAULT;
> + }
> }
> return ret;
> }
> --
> 2.42.2
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-08-14 13:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-08-14 11:08 [PATCH] hw/virtio/virtio-pci: add defensive check for vector_irqfd gerben
2025-08-14 11:47 ` Philippe Mathieu-Daudé
2025-08-14 13:07 ` Michael S. Tsirkin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).