mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

vfio-container-base: Introduce vfio_container_get_iova_ranges() helper

Browse Source 
Introduce vfio_container_get_iova_ranges() to retrieve the usable
IOVA regions of the base container and use it in the Host IOMMU
device implementations of get_iova_ranges() callback.

We also fix a UAF bug as the list was shallow copied while
g_list_free_full() was used both on the single call site, in
virtio_iommu_set_iommu_device() but also in
vfio_container_instance_finalize(). Instead use g_list_copy_deep.

Fixes: cf2647a76e ("virtio-iommu: Compute host reserved regions")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Suggested-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Eric Auger 2024-07-01 10:48:54 +02:00 committed by Cédric Le Goater
parent 37baedf8e8
commit 3966bca539
4 changed files with 19 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
hw/vfio/container-base.c
View File

@ -83,6 +83,21 @@ int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
errp);
}
static gpointer copy_iova_range(gconstpointer src, gpointer data)
{
Range *source = (Range *)src;
Range *dest = g_new(Range, 1);
range_set_bounds(dest, range_lob(source), range_upb(source));
return dest;
}
GList *vfio_container_get_iova_ranges(const VFIOContainerBase *bcontainer)
{
assert(bcontainer);
return g_list_copy_deep(bcontainer->iova_ranges, copy_iova_range, NULL);
}
static void vfio_container_instance_finalize(Object *obj)
{
VFIOContainerBase *bcontainer = VFIO_IOMMU(obj);

8
hw/vfio/container.c
View File

@ -1168,15 +1168,9 @@ static GList *
hiod_legacy_vfio_get_iova_ranges(HostIOMMUDevice *hiod, Error **errp)
{
VFIODevice *vdev = hiod->agent;
GList *l = NULL;
g_assert(vdev);
if (vdev->bcontainer) {
l = g_list_copy(vdev->bcontainer->iova_ranges);
}
return l;
return vfio_container_get_iova_ranges(vdev->bcontainer);
}
static void vfio_iommu_legacy_instance_init(Object *obj)

8
hw/vfio/iommufd.c
View File

@ -647,15 +647,9 @@ static GList *
hiod_iommufd_vfio_get_iova_ranges(HostIOMMUDevice *hiod, Error **errp)
{
VFIODevice *vdev = hiod->agent;
GList *l = NULL;
g_assert(vdev);
if (vdev->bcontainer) {
l = g_list_copy(vdev->bcontainer->iova_ranges);
}
return l;
return vfio_container_get_iova_ranges(vdev->bcontainer);
}
static void hiod_iommufd_vfio_class_init(ObjectClass *oc, void *data)

2
include/hw/vfio/vfio-container-base.h
View File

@ -86,6 +86,8 @@ int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp);
GList *vfio_container_get_iova_ranges(const VFIOContainerBase *bcontainer);
#define TYPE_VFIO_IOMMU "vfio-iommu"
#define TYPE_VFIO_IOMMU_LEGACY TYPE_VFIO_IOMMU "-legacy"
#define TYPE_VFIO_IOMMU_SPAPR TYPE_VFIO_IOMMU "-spapr"