[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset

From: Jason Wang
Subject: Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset
Date: Wed, 8 Mar 2017 17:53:23 +0800
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0

On 2017年03月08日 17:30, Cornelia Huck wrote:
On Wed, 8 Mar 2017 14:22:06 +0800
Jason Wang <address@hidden> wrote:

On 2017年03月08日 11:21, Jason Wang wrote:
On 2017年03月07日 18:55, Paolo Bonzini wrote:
On 07/03/2017 09:47, Jason Wang wrote:
We don't destroy region cache during reset which can make the maps
of previous driver leaked to a buggy or malicious driver that don't
set vring address before starting to use the device.
I'm still not sure as to how this can happen.  Reset does clear
desc/used/avail, which should then be checked before accessing the
But the code does not check them in fact? (E.g the attached qtest
patch can still pass check-qtest).

Ok, the reproducer seems wrong. And I think what you mean is something
like the check done in virtio_queue_ready(). But looks like not all
virtqueue check for this. One example is virtio_net_handle_ctrl(), and
Shouldn't the check for desc in virtio_queue_notify_vq() already take
care of that?

Yes, I miss this.

there may be even more. So you want to fix them all?
Obviously not speaking for Paolo, but I think the virtio core should
have be audited for missing guards.

Probably, otherwise we need a careful auditing of all callers of caches.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]