* [PATCH] virtio: update MemoryRegionCaches when guest set bad features
@ 2020-09-19 8:27 Li Qiang
2020-09-20 11:54 ` Paolo Bonzini
0 siblings, 1 reply; 2+ messages in thread
From: Li Qiang @ 2020-09-19 8:27 UTC (permalink / raw)
To: pbonzini, mst; +Cc: Li Qiang, qemu-devel
Current the 'virtio_set_features' only update the 'MemorRegionCaches'
when the 'virtio_set_features_nocheck' return '0' which means it is
not bad features. However the guest can still trigger the access of the
used vring after set bad features. In this situation it will cause assert
failure in 'ADDRESS_SPACE_ST_CACHED'.
Buglink: https://bugs.launchpad.net/qemu/+bug/1890333
Fixes: db812c4073c7 ("virtio: update MemoryRegionCaches when guest negotiates features")
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Li Qiang <liq3ea@163.com>
---
hw/virtio/virtio.c | 17 ++++++++---------
1 file changed, 8 insertions(+), 9 deletions(-)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index e983025217..4441ae5ed4 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2963,17 +2963,16 @@ int virtio_set_features(VirtIODevice *vdev, uint64_t val)
return -EINVAL;
}
ret = virtio_set_features_nocheck(vdev, val);
- if (!ret) {
- if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
- /* VIRTIO_RING_F_EVENT_IDX changes the size of the caches. */
- int i;
- for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
- if (vdev->vq[i].vring.num != 0) {
- virtio_init_region_cache(vdev, i);
- }
+ if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
+ /* VIRTIO_RING_F_EVENT_IDX changes the size of the caches. */
+ int i;
+ for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
+ if (vdev->vq[i].vring.num != 0) {
+ virtio_init_region_cache(vdev, i);
}
}
-
+ }
+ if (!ret) {
if (!virtio_device_started(vdev, vdev->status) &&
!virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
vdev->start_on_kick = true;
--
2.17.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] virtio: update MemoryRegionCaches when guest set bad features
2020-09-19 8:27 [PATCH] virtio: update MemoryRegionCaches when guest set bad features Li Qiang
@ 2020-09-20 11:54 ` Paolo Bonzini
0 siblings, 0 replies; 2+ messages in thread
From: Paolo Bonzini @ 2020-09-20 11:54 UTC (permalink / raw)
To: Li Qiang, mst; +Cc: qemu-devel
On 19/09/20 10:27, Li Qiang wrote:
> Current the 'virtio_set_features' only update the 'MemorRegionCaches'
> when the 'virtio_set_features_nocheck' return '0' which means it is
> not bad features. However the guest can still trigger the access of the
> used vring after set bad features. In this situation it will cause assert
> failure in 'ADDRESS_SPACE_ST_CACHED'.
>
> Buglink: https://bugs.launchpad.net/qemu/+bug/1890333
> Fixes: db812c4073c7 ("virtio: update MemoryRegionCaches when guest negotiates features")
> Reported-by: Alexander Bulekov <alxndr@bu.edu>
> Signed-off-by: Li Qiang <liq3ea@163.com>
> ---
> hw/virtio/virtio.c | 17 ++++++++---------
> 1 file changed, 8 insertions(+), 9 deletions(-)
>
> diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
> index e983025217..4441ae5ed4 100644
> --- a/hw/virtio/virtio.c
> +++ b/hw/virtio/virtio.c
> @@ -2963,17 +2963,16 @@ int virtio_set_features(VirtIODevice *vdev, uint64_t val)
> return -EINVAL;
> }
> ret = virtio_set_features_nocheck(vdev, val);
> - if (!ret) {
> - if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
> - /* VIRTIO_RING_F_EVENT_IDX changes the size of the caches. */
> - int i;
> - for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
> - if (vdev->vq[i].vring.num != 0) {
> - virtio_init_region_cache(vdev, i);
> - }
> + if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
> + /* VIRTIO_RING_F_EVENT_IDX changes the size of the caches. */
> + int i;
> + for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
> + if (vdev->vq[i].vring.num != 0) {
> + virtio_init_region_cache(vdev, i);
> }
> }
> -
> + }
> + if (!ret) {
> if (!virtio_device_started(vdev, vdev->status) &&
> !virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
> vdev->start_on_kick = true;
>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-09-20 11:56 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-19 8:27 [PATCH] virtio: update MemoryRegionCaches when guest set bad features Li Qiang
2020-09-20 11:54 ` Paolo Bonzini
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).