[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 72/73] virtio: fix reachable assertion due to stale value of cache
From: |
Michael S. Tsirkin |
Subject: |
[PULL 72/73] virtio: fix reachable assertion due to stale value of cached region size |
Date: |
Tue, 7 Mar 2023 20:14:25 -0500 |
From: Carlos López <clopez@suse.de>
In virtqueue_{split,packed}_get_avail_bytes() descriptors are read
in a loop via MemoryRegionCache regions and calls to
vring_{split,packed}_desc_read() - these take a region cache and the
index of the descriptor to be read.
For direct descriptors we use a cache provided by the caller, whose
size matches that of the virtqueue vring. We limit the number of
descriptors we can read by the size of that vring:
max = vq->vring.num;
...
MemoryRegionCache *desc_cache = &caches->desc;
For indirect descriptors, we initialize a new cache and limit the
number of descriptors by the size of the intermediate descriptor:
len = address_space_cache_init(&indirect_desc_cache,
vdev->dma_as,
desc.addr, desc.len, false);
desc_cache = &indirect_desc_cache;
...
max = desc.len / sizeof(VRingDesc);
However, the first initialization of `max` is done outside the loop
where we process guest descriptors, while the second one is done
inside. This means that a sequence of an indirect descriptor followed
by a direct one will leave a stale value in `max`. If the second
descriptor's `next` field is smaller than the stale value, but
greater than the size of the virtqueue ring (and thus the cached
region), a failed assertion will be triggered in
address_space_read_cached() down the call chain.
Fix this by initializing `max` inside the loop in both functions.
Fixes: 9796d0ac8fb0 ("virtio: use address_space_map/unmap to access
descriptors")
Signed-off-by: Carlos López <clopez@suse.de>
Message-Id: <20230302100358.3613-1-clopez@suse.de>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
hw/virtio/virtio.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index f35178f5fc..98c4819fcc 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -1069,7 +1069,7 @@ static void virtqueue_split_get_avail_bytes(VirtQueue *vq,
VRingMemoryRegionCaches *caches)
{
VirtIODevice *vdev = vq->vdev;
- unsigned int max, idx;
+ unsigned int idx;
unsigned int total_bufs, in_total, out_total;
MemoryRegionCache indirect_desc_cache = MEMORY_REGION_CACHE_INVALID;
int64_t len = 0;
@@ -1078,13 +1078,12 @@ static void virtqueue_split_get_avail_bytes(VirtQueue
*vq,
idx = vq->last_avail_idx;
total_bufs = in_total = out_total = 0;
- max = vq->vring.num;
-
while ((rc = virtqueue_num_heads(vq, idx)) > 0) {
MemoryRegionCache *desc_cache = &caches->desc;
unsigned int num_bufs;
VRingDesc desc;
unsigned int i;
+ unsigned int max = vq->vring.num;
num_bufs = total_bufs;
@@ -1206,7 +1205,7 @@ static void virtqueue_packed_get_avail_bytes(VirtQueue
*vq,
VRingMemoryRegionCaches *caches)
{
VirtIODevice *vdev = vq->vdev;
- unsigned int max, idx;
+ unsigned int idx;
unsigned int total_bufs, in_total, out_total;
MemoryRegionCache *desc_cache;
MemoryRegionCache indirect_desc_cache = MEMORY_REGION_CACHE_INVALID;
@@ -1218,14 +1217,14 @@ static void virtqueue_packed_get_avail_bytes(VirtQueue
*vq,
wrap_counter = vq->last_avail_wrap_counter;
total_bufs = in_total = out_total = 0;
- max = vq->vring.num;
-
for (;;) {
unsigned int num_bufs = total_bufs;
unsigned int i = idx;
int rc;
+ unsigned int max = vq->vring.num;
desc_cache = &caches->desc;
+
vring_packed_desc_read(vdev, &desc, desc_cache, idx, true);
if (!is_desc_avail(desc.flags, wrap_counter)) {
break;
--
MST
- [PULL 62/73] hw/pci/aer: Add missing routing for AER errors, (continued)
- [PULL 62/73] hw/pci/aer: Add missing routing for AER errors, Michael S. Tsirkin, 2023/03/07
- [PULL 63/73] hw/pci-bridge/cxl_root_port: Wire up AER, Michael S. Tsirkin, 2023/03/07
- [PULL 64/73] hw/pci-bridge/cxl_root_port: Wire up MSI, Michael S. Tsirkin, 2023/03/07
- [PULL 65/73] hw/mem/cxl-type3: Add AER extended capability, Michael S. Tsirkin, 2023/03/07
- [PULL 66/73] hw/cxl: Fix endian issues in CXL RAS capability defaults / masks, Michael S. Tsirkin, 2023/03/07
- [PULL 67/73] hw/pci/aer: Make PCIE AER error injection facility available for other emulation to use., Michael S. Tsirkin, 2023/03/07
- [PULL 68/73] hw/mem/cxl_type3: Add CXL RAS Error Injection Support., Michael S. Tsirkin, 2023/03/07
- [PULL 69/73] hw/pci: Add pcie_count_ds_port() and pcie_find_port_first() helpers, Michael S. Tsirkin, 2023/03/07
- [PULL 71/73] hw/virtio/vhost-user: avoid using unitialized errp, Michael S. Tsirkin, 2023/03/07
- [PULL 70/73] hw/pxb-cxl: Support passthrough HDM Decoders unless overridden, Michael S. Tsirkin, 2023/03/07
- [PULL 72/73] virtio: fix reachable assertion due to stale value of cached region size,
Michael S. Tsirkin <=
- [PULL 73/73] virtio: refresh vring region cache after updating a virtqueue size, Michael S. Tsirkin, 2023/03/07
- Re: [PULL 00/73] virtio,pc,pci: features, fixes, Michael S. Tsirkin, 2023/03/09
- Re: [PULL 00/73] virtio,pc,pci: features, fixes, Peter Maydell, 2023/03/10
- Re: [PULL 00/73] virtio,pc,pci: features, fixes, Philippe Mathieu-Daudé, 2023/03/10
- Re: [PULL 00/73] virtio,pc,pci: features, fixes, Michael S. Tsirkin, 2023/03/11
- Re: [PULL 00/73] virtio,pc,pci: features, fixes, Philippe Mathieu-Daudé, 2023/03/13