mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-12-26 01:18:36 -07:00
a2e1753b80
Add a flag to the DeviceState, when a device is engaged in PIO/MMIO/DMA. This flag is set/checked prior to calling a device's MemoryRegion handlers, and set when device code initiates DMA. The purpose of this flag is to prevent two types of DMA-based reentrancy issues: 1.) mmio -> dma -> mmio case 2.) bh -> dma write -> mmio case These issues have led to problems such as stack-exhaustion and use-after-frees. Summary of the problem from Peter Maydell: https://lore.kernel.org/qemu-devel/CAFEAcA_23vc7hE3iaM-JVA6W38LK4hJoWae5KcknhPRD5fPBZA@mail.gmail.com Resolves: https://gitlab.com/qemu-project/qemu/-/issues/62 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/540 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/541 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/556 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/557 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/827 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1282 Resolves: CVE-2023-0330 Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Reviewed-by: Thomas Huth <thuth@redhat.com> Message-Id: <20230427211013.2994127-2-alxndr@bu.edu> [thuth: Replace warn_report() with warn_report_once()] Signed-off-by: Thomas Huth <thuth@redhat.com> |
||
|---|---|---|
| .. | ||
| user | ||
| address-spaces.h | ||
| confidential-guest-support.h | ||
| cpu-all.h | ||
| cpu-common.h | ||
| cpu-defs.h | ||
| cpu_ldst.h | ||
| cputlb.h | ||
| exec-all.h | ||
| gdbstub.h | ||
| gen-icount.h | ||
| helper-gen.h | ||
| helper-head.h | ||
| helper-proto.h | ||
| helper-tcg.h | ||
| hwaddr.h | ||
| ioport.h | ||
| log.h | ||
| memattrs.h | ||
| memop.h | ||
| memopidx.h | ||
| memory-internal.h | ||
| memory.h | ||
| memory_ldst.h.inc | ||
| memory_ldst_cached.h.inc | ||
| memory_ldst_phys.h.inc | ||
| page-vary.h | ||
| plugin-gen.h | ||
| poison.h | ||
| ram_addr.h | ||
| ramblock.h | ||
| ramlist.h | ||
| replay-core.h | ||
| target_long.h | ||
| target_page.h | ||
| tb-flush.h | ||
| translate-all.h | ||
| translator.h | ||
| tswap.h | ||