7bd04a041a
Fuzzing discovered that virtqueue_unmap_sg() is being called on modified
req->in/out_sg iovecs. This means dma_memory_map() and
dma_memory_unmap() calls do not have matching memory addresses.
Fuzzing discovered that non-RAM addresses trigger a bug:
void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
bool is_write, hwaddr access_len)
{
if (buffer != bounce.buffer) {
^^^^^^^^^^^^^^^^^^^^^^^
A modified iov->iov_base is no longer recognized as a bounce buffer and
the wrong branch is taken.
There are more potential bugs: dirty memory is not tracked correctly and
MemoryRegion refcounts can be leaked.
Use the new iov_discard_undo() API to restore elem->in/out_sg before
virtqueue_push() is called.
Fixes: 827805a249 ("virtio-blk: Convert VirtIOBlockReq.out to structrue")
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Buglink: https://bugs.launchpad.net/qemu/+bug/1890360
Message-Id: <20200917094455.822379-3-stefanha@redhat.com>
96 lines
2.2 KiB
C
96 lines
2.2 KiB
C
/*
|
|
* Virtio Block Device
|
|
*
|
|
* Copyright IBM, Corp. 2007
|
|
*
|
|
* Authors:
|
|
* Anthony Liguori <aliguori@us.ibm.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2. See
|
|
* the COPYING file in the top-level directory.
|
|
*
|
|
*/
|
|
|
|
#ifndef QEMU_VIRTIO_BLK_H
|
|
#define QEMU_VIRTIO_BLK_H
|
|
|
|
#include "standard-headers/linux/virtio_blk.h"
|
|
#include "hw/virtio/virtio.h"
|
|
#include "hw/block/block.h"
|
|
#include "sysemu/iothread.h"
|
|
#include "sysemu/block-backend.h"
|
|
#include "qom/object.h"
|
|
|
|
#define TYPE_VIRTIO_BLK "virtio-blk-device"
|
|
OBJECT_DECLARE_SIMPLE_TYPE(VirtIOBlock, VIRTIO_BLK)
|
|
|
|
/* This is the last element of the write scatter-gather list */
|
|
struct virtio_blk_inhdr
|
|
{
|
|
unsigned char status;
|
|
};
|
|
|
|
#define VIRTIO_BLK_AUTO_NUM_QUEUES UINT16_MAX
|
|
|
|
struct VirtIOBlkConf
|
|
{
|
|
BlockConf conf;
|
|
IOThread *iothread;
|
|
char *serial;
|
|
uint32_t request_merging;
|
|
uint16_t num_queues;
|
|
uint16_t queue_size;
|
|
bool seg_max_adjust;
|
|
uint32_t max_discard_sectors;
|
|
uint32_t max_write_zeroes_sectors;
|
|
bool x_enable_wce_if_config_wce;
|
|
};
|
|
|
|
struct VirtIOBlockDataPlane;
|
|
|
|
struct VirtIOBlockReq;
|
|
struct VirtIOBlock {
|
|
VirtIODevice parent_obj;
|
|
BlockBackend *blk;
|
|
void *rq;
|
|
QEMUBH *bh;
|
|
VirtIOBlkConf conf;
|
|
unsigned short sector_mask;
|
|
bool original_wce;
|
|
VMChangeStateEntry *change;
|
|
bool dataplane_disabled;
|
|
bool dataplane_started;
|
|
struct VirtIOBlockDataPlane *dataplane;
|
|
uint64_t host_features;
|
|
size_t config_size;
|
|
};
|
|
|
|
typedef struct VirtIOBlockReq {
|
|
VirtQueueElement elem;
|
|
int64_t sector_num;
|
|
VirtIOBlock *dev;
|
|
VirtQueue *vq;
|
|
IOVDiscardUndo inhdr_undo;
|
|
IOVDiscardUndo outhdr_undo;
|
|
struct virtio_blk_inhdr *in;
|
|
struct virtio_blk_outhdr out;
|
|
QEMUIOVector qiov;
|
|
size_t in_len;
|
|
struct VirtIOBlockReq *next;
|
|
struct VirtIOBlockReq *mr_next;
|
|
BlockAcctCookie acct;
|
|
} VirtIOBlockReq;
|
|
|
|
#define VIRTIO_BLK_MAX_MERGE_REQS 32
|
|
|
|
typedef struct MultiReqBuffer {
|
|
VirtIOBlockReq *reqs[VIRTIO_BLK_MAX_MERGE_REQS];
|
|
unsigned int num_reqs;
|
|
bool is_write;
|
|
} MultiReqBuffer;
|
|
|
|
bool virtio_blk_handle_vq(VirtIOBlock *s, VirtQueue *vq);
|
|
void virtio_blk_process_queued_requests(VirtIOBlock *s, bool is_bh);
|
|
|
|
#endif
|