mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

memory: prevent dma-reentracy issues

Browse Source 
Add a flag to the DeviceState, when a device is engaged in PIO/MMIO/DMA.
This flag is set/checked prior to calling a device's MemoryRegion
handlers, and set when device code initiates DMA.  The purpose of this
flag is to prevent two types of DMA-based reentrancy issues:

1.) mmio -> dma -> mmio case
2.) bh -> dma write -> mmio case

These issues have led to problems such as stack-exhaustion and
use-after-frees.

Summary of the problem from Peter Maydell:
https://lore.kernel.org/qemu-devel/CAFEAcA_23vc7hE3iaM-JVA6W38LK4hJoWae5KcknhPRD5fPBZA@mail.gmail.com

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/62
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/540
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/541
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/556
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/557
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/827
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1282
Resolves: CVE-2023-0330

Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230427211013.2994127-2-alxndr@bu.edu>
[thuth: Replace warn_report() with warn_report_once()]
Signed-off-by: Thomas Huth <thuth@redhat.com>
This commit is contained in:
Alexander Bulekov 2023-04-27 17:10:06 -04:00 committed by Thomas Huth
parent 3ee7f21ed2
commit a2e1753b80
3 changed files with 28 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
include/exec/memory.h
View File

@ -767,6 +767,8 @@ struct MemoryRegion {
bool is_iommu; bool is_iommu;
RAMBlock *ram_block; RAMBlock *ram_block;
Object *owner; Object *owner;
/* owner as TYPE_DEVICE. Used for re-entrancy checks in MR access hotpath */
DeviceState *dev;
const MemoryRegionOps *ops; const MemoryRegionOps *ops;
void *opaque; void *opaque;
@ -791,6 +793,9 @@ struct MemoryRegion {
unsigned ioeventfd_nb; unsigned ioeventfd_nb;
MemoryRegionIoeventfd *ioeventfds; MemoryRegionIoeventfd *ioeventfds;
RamDiscardManager *rdm; /* Only for RAM */ RamDiscardManager *rdm; /* Only for RAM */
/* For devices designed to perform re-entrant IO into their own IO MRs */
bool disable_reentrancy_guard;
}; };
struct IOMMUMemoryRegion { struct IOMMUMemoryRegion {

7
include/hw/qdev-core.h
View File

@ -162,6 +162,10 @@ struct NamedClockList {
QLIST_ENTRY(NamedClockList) node; QLIST_ENTRY(NamedClockList) node;
}; };
typedef struct {
bool engaged_in_io;
} MemReentrancyGuard;
/** /**
* DeviceState: * DeviceState:
* @realized: Indicates whether the device has been fully constructed. * @realized: Indicates whether the device has been fully constructed.
@ -194,6 +198,9 @@ struct DeviceState {
int alias_required_for_version; int alias_required_for_version;
ResettableState reset; ResettableState reset;
GSList *unplug_blockers; GSList *unplug_blockers;
/* Is the device currently in mmio/pio/dma? Used to prevent re-entrancy */
MemReentrancyGuard mem_reentrancy_guard;
}; };
struct DeviceListener { struct DeviceListener {

16
softmmu/memory.c
View File

@ -542,6 +542,18 @@ static MemTxResult access_with_adjusted_size(hwaddr addr,
access_size_max = 4; access_size_max = 4;
} }
/* Do not allow more than one simultaneous access to a device's IO Regions */
if (mr->dev && !mr->disable_reentrancy_guard &&
!mr->ram_device && !mr->ram && !mr->rom_device && !mr->readonly) {
if (mr->dev->mem_reentrancy_guard.engaged_in_io) {
warn_report_once("Blocked re-entrant IO on MemoryRegion: "
"%s at addr: 0x%" HWADDR_PRIX,
memory_region_name(mr), addr);
return MEMTX_ACCESS_ERROR;
}
mr->dev->mem_reentrancy_guard.engaged_in_io = true;
}
/* FIXME: support unaligned access? */ /* FIXME: support unaligned access? */
access_size = MAX(MIN(size, access_size_max), access_size_min); access_size = MAX(MIN(size, access_size_max), access_size_min);
access_mask = MAKE_64BIT_MASK(0, access_size * 8); access_mask = MAKE_64BIT_MASK(0, access_size * 8);
@ -556,6 +568,9 @@ static MemTxResult access_with_adjusted_size(hwaddr addr,
access_mask, attrs); access_mask, attrs);
} }
} }
if (mr->dev) {
mr->dev->mem_reentrancy_guard.engaged_in_io = false;
}
return r; return r;
} }
@ -1170,6 +1185,7 @@ static void memory_region_do_init(MemoryRegion *mr,
} }
mr->name = g_strdup(name); mr->name = g_strdup(name);
mr->owner = owner; mr->owner = owner;
mr->dev = (DeviceState *) object_dynamic_cast(mr->owner, TYPE_DEVICE);
mr->ram_block = NULL; mr->ram_block = NULL;
if (name) { if (name) {