[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset |
Date: |
Wed, 8 Mar 2017 04:10:26 -0500 (EST) |
----- Original Message -----
> From: "Jason Wang" <address@hidden>
> To: "Paolo Bonzini" <address@hidden>, address@hidden, address@hidden
> Cc: address@hidden
> Sent: Wednesday, March 8, 2017 7:22:06 AM
> Subject: Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset
>
>
>
> On 2017年03月08日 11:21, Jason Wang wrote:
> >
> > On 2017年03月07日 18:55, Paolo Bonzini wrote:
> >>
> >> On 07/03/2017 09:47, Jason Wang wrote:
> >>> We don't destroy region cache during reset which can make the maps
> >>> of previous driver leaked to a buggy or malicious driver that don't
> >>> set vring address before starting to use the device.
> >> I'm still not sure as to how this can happen. Reset does clear
> >> desc/used/avail, which should then be checked before accessing the
> >> caches.
> >
> > But the code does not check them in fact? (E.g the attached qtest
> > patch can still pass check-qtest).
> >
> > Thanks
>
> Ok, the reproducer seems wrong. And I think what you mean is something
> like the check done in virtio_queue_ready(). But looks like not all
> virtqueue check for this. One example is virtio_net_handle_ctrl(), and
> there may be even more. So you want to fix them all?
Why would virtio_net_handle_ctrl be called when desc == 0? The checks
are all in common virtio code.
static void virtio_queue_notify_vq(VirtQueue *vq)
{
if (vq->vring.desc && vq->handle_output) {
VirtIODevice *vdev = vq->vdev;
if (unlikely(vdev->broken)) {
return;
}
trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
vq->handle_output(vdev, vq);
}
}
1440,29 55%
Paolo
- Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, (continued)
- Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Cornelia Huck, 2017/03/08
- Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Jason Wang, 2017/03/08
- Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Cornelia Huck, 2017/03/08
- Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Jason Wang, 2017/03/08
- Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Cornelia Huck, 2017/03/09
- Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Paolo Bonzini, 2017/03/09
- Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Cornelia Huck, 2017/03/09
Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Paolo Bonzini, 2017/03/07
Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Cornelia Huck, 2017/03/08
Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Jason Wang, 2017/03/08
Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset, Cornelia Huck, 2017/03/08