[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset

From: Jason Wang
Subject: Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset
Date: Wed, 8 Mar 2017 17:48:11 +0800
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0

On 2017年03月08日 17:10, Paolo Bonzini wrote:

----- Original Message -----
From: "Jason Wang" <address@hidden>
To: "Paolo Bonzini" <address@hidden>, address@hidden, address@hidden
Cc: address@hidden
Sent: Wednesday, March 8, 2017 7:22:06 AM
Subject: Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset

On 2017年03月08日 11:21, Jason Wang wrote:
On 2017年03月07日 18:55, Paolo Bonzini wrote:
On 07/03/2017 09:47, Jason Wang wrote:
We don't destroy region cache during reset which can make the maps
of previous driver leaked to a buggy or malicious driver that don't
set vring address before starting to use the device.
I'm still not sure as to how this can happen.  Reset does clear
desc/used/avail, which should then be checked before accessing the
But the code does not check them in fact? (E.g the attached qtest
patch can still pass check-qtest).

Ok, the reproducer seems wrong. And I think what you mean is something
like the check done in virtio_queue_ready(). But looks like not all
virtqueue check for this. One example is virtio_net_handle_ctrl(), and
there may be even more. So you want to fix them all?
Why would virtio_net_handle_ctrl be called when desc == 0?  The checks
are all in common virtio code.

static void virtio_queue_notify_vq(VirtQueue *vq)
     if (vq->vring.desc && vq->handle_output) {
         VirtIODevice *vdev = vq->vdev;

         if (unlikely(vdev->broken)) {

         trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
         vq->handle_output(vdev, vq);
                1440,29       55%

Right, I miss this.

But I find two possible leaks by auditing the callers of virtqueue_pop():

virtio_input_send() and virtio_balloon_set_status() which will call virtio_balloon_receive_stats().


reply via email to

[Prev in Thread] Current Thread [Next in Thread]