mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

virtio-balloon: Prevent guest from starting a report when we didn't request one

Browse Source 
Based on code review it appears possible for the driver to force the device
out of a stopped state when hinting by repeating the last ID it was
provided.

Prevent this by only allowing a transition to the start state when we are
in the requested state. This way the driver is only allowed to send one
descriptor that will transition the device into the start state. All others
will leave it in the stop state once it has finished.

Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT")
Acked-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Alexander Duyck <alexander.h.duyck@linux.intel.com>
Message-Id: <20200720175115.21935.99563.stgit@localhost.localdomain>
Cc: qemu-stable@nongnu.org
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Alexander Duyck 2020-07-20 10:51:15 -07:00 committed by Michael S. Tsirkin
parent cf4e3d000e
commit 20a4da0f23
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
hw/virtio/virtio-balloon.c
View File

@ -526,7 +526,8 @@ static bool get_free_page_hints(VirtIOBalloon *dev)
ret = false;
goto out;
}
if (id == dev->free_page_report_cmd_id) {
if (dev->free_page_report_status == FREE_PAGE_REPORT_S_REQUESTED &&
id == dev->free_page_report_cmd_id) {
dev->free_page_report_status = FREE_PAGE_REPORT_S_START;
} else {
/*