|
From: | Jason Wang |
Subject: | Re: [Qemu-devel] [PATCH] virtio: destroy region cache during reset |
Date: | Wed, 8 Mar 2017 14:22:06 +0800 |
User-agent: | Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 |
On 2017年03月08日 11:21, Jason Wang wrote:
On 2017年03月07日 18:55, Paolo Bonzini wrote:On 07/03/2017 09:47, Jason Wang wrote:We don't destroy region cache during reset which can make the maps of previous driver leaked to a buggy or malicious driver that don't set vring address before starting to use the device.I'm still not sure as to how this can happen. Reset does cleardesc/used/avail, which should then be checked before accessing the caches.But the code does not check them in fact? (E.g the attached qtest patch can still pass check-qtest).Thanks
Ok, the reproducer seems wrong. And I think what you mean is something like the check done in virtio_queue_ready(). But looks like not all virtqueue check for this. One example is virtio_net_handle_ctrl(), and there may be even more. So you want to fix them all?
Thanks
[Prev in Thread] | Current Thread | [Next in Thread] |