a021a2dd8b
In some cases, a particular mapcache entry may be mapped 256 times causing the lock field to wrap to 0. For example, this may happen when using emulated NVME and the guest submits a large scatter-gather write. At this point, the entry map be remapped causing QEMU to write the wrong data or crash (since remap is not atomic). Avoid this overflow by increasing the lock field to a uint32_t and also detect it and abort rather than continuing regardless. Signed-off-by: Ross Lagerwall <ross.lagerwall@citrix.com> Reviewed-by: Paul Durrant <paul@xen.org> Reviewed-by: Stefano Stabellini <sstabellini@kernel.org> Message-Id: <20220124104450.152481-1-ross.lagerwall@citrix.com> Signed-off-by: Anthony PERARD <anthony.perard@citrix.com> |
||
|---|---|---|
| .. | ||
| meson.build | ||
| trace-events | ||
| trace.h | ||
| xen-hvm.c | ||
| xen-mapcache.c | ||
| xen_apic.c | ||
| xen_platform.c | ||
| xen_pvdevice.c | ||