f0d634ea19
When a virtqueue size is changed by the guest via
virtio_queue_set_num(), its region cache is not automatically updated.
If the size was increased, this could lead to accessing the cache out
of bounds. For example, in vring_get_used_event():
static inline uint16_t vring_get_used_event(VirtQueue *vq)
{
return vring_avail_ring(vq, vq->vring.num);
}
static inline uint16_t vring_avail_ring(VirtQueue *vq, int i)
{
VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
hwaddr pa = offsetof(VRingAvail, ring[i]);
if (!caches) {
return 0;
}
return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
}
vq->vring.num will be greater than caches->avail.len, which will
trigger a failed assertion down the call path of
virtio_lduw_phys_cached().
Fix this by calling virtio_init_region_cache() after
virtio_queue_set_num() if we are not already calling
virtio_queue_set_rings(). In the legacy path this is already done by
virtio_queue_update_rings().
Signed-off-by: Carlos López <clopez@suse.de>
Message-Id: <20230317002749.27379-1-clopez@suse.de>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Acked-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
|
||
|---|---|---|
| .. | ||
| 3270-ccw.c | ||
| ap-bridge.c | ||
| ap-device.c | ||
| ccw-device.c | ||
| ccw-device.h | ||
| css-bridge.c | ||
| css.c | ||
| event-facility.c | ||
| ipl.c | ||
| ipl.h | ||
| Kconfig | ||
| meson.build | ||
| pv.c | ||
| s390-ccw.c | ||
| s390-pci-bus.c | ||
| s390-pci-inst.c | ||
| s390-pci-kvm.c | ||
| s390-pci-vfio.c | ||
| s390-skeys-kvm.c | ||
| s390-skeys.c | ||
| s390-stattrib-kvm.c | ||
| s390-stattrib.c | ||
| s390-virtio-ccw.c | ||
| s390-virtio-hcall.c | ||
| s390-virtio-hcall.h | ||
| sclp.c | ||
| sclpcpu.c | ||
| sclpquiesce.c | ||
| tod-kvm.c | ||
| tod-tcg.c | ||
| tod.c | ||
| trace-events | ||
| trace.h | ||
| vhost-scsi-ccw.c | ||
| vhost-user-fs-ccw.c | ||
| vhost-vsock-ccw.c | ||
| virtio-ccw-9p.c | ||
| virtio-ccw-balloon.c | ||
| virtio-ccw-blk.c | ||
| virtio-ccw-crypto.c | ||
| virtio-ccw-gpu.c | ||
| virtio-ccw-input.c | ||
| virtio-ccw-net.c | ||
| virtio-ccw-rng.c | ||
| virtio-ccw-scsi.c | ||
| virtio-ccw-serial.c | ||
| virtio-ccw.c | ||
| virtio-ccw.h | ||