Re: [Qemu-devel] [PATCH RFC for-2.2] virtio-blk: force 1st s/g to match header

[Peter Maydell]

On 30 November 2014 at 16:43, Michael S. Tsirkin <address@hidden> wrote:
> The result of this is host mapping leak.
> What effect does this have? Can this DOS host?

I don't think we can DOS the host here.

If Xen, we crash (but you can't use virtio-blk with Xen anyway)
Otherwise, if you managed to get address_space_map() to hand you
the bounce-buffer (by asking for dma to something other than RAM)
then we'll either hit an assertion or just end up never allowing
dma to/from non-RAM ever again for this guest.
The usual case would be that this was dma to/from ram, in
which case it's harmless if the virtio-backend never wrote to
the memory, and will fail to update dirty bitmaps for migration
etc if the backend did write.

In any case I think that none of these outcomes are worse
than the "exit(1)" the current patch proposes.

-- PMM