Re: [Qemu-devel] [PATCH RFC for-2.2] virtio-blk: force 1st s/g to match header

[Michael S. Tsirkin]

On Mon, Dec 01, 2014 at 12:07:07PM +0000, Peter Maydell wrote:
> On 30 November 2014 at 16:43, Michael S. Tsirkin <address@hidden> wrote:
> > The result of this is host mapping leak.
> > What effect does this have? Can this DOS host?
> 
> I don't think we can DOS the host here.
> 
> If Xen, we crash (but you can't use virtio-blk with Xen anyway)
> Otherwise, if you managed to get address_space_map() to hand you
> the bounce-buffer (by asking for dma to something other than RAM)
> then we'll either hit an assertion or just end up never allowing
> dma to/from non-RAM ever again for this guest.
> The usual case would be that this was dma to/from ram, in
> which case it's harmless if the virtio-backend never wrote to
> the memory, and will fail to update dirty bitmaps for migration
> etc if the backend did write.
> 
> In any case I think that none of these outcomes are worse
> than the "exit(1)" the current patch proposes.
> 
> -- PMM

Fair enough.
Pls disregard the patch then, and we'll fix it properly
for 2.3 when we set ANY_LAYOUT.