mirror of
https://github.com/Motorhead1991/qemu.git
synced 2026-03-01 07:34:35 -07:00
7bd04a041a
Fuzzing discovered that virtqueue_unmap_sg() is being called on modified
req->in/out_sg iovecs. This means dma_memory_map() and
dma_memory_unmap() calls do not have matching memory addresses.
Fuzzing discovered that non-RAM addresses trigger a bug:
void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len,
bool is_write, hwaddr access_len)
{
if (buffer != bounce.buffer) {
^^^^^^^^^^^^^^^^^^^^^^^
A modified iov->iov_base is no longer recognized as a bounce buffer and
the wrong branch is taken.
There are more potential bugs: dirty memory is not tracked correctly and
MemoryRegion refcounts can be leaked.
Use the new iov_discard_undo() API to restore elem->in/out_sg before
virtqueue_push() is called.
Fixes:
|
||
|---|---|---|
| .. | ||
| dataplane | ||
| block.c | ||
| cdrom.c | ||
| ecc.c | ||
| fdc.c | ||
| hd-geometry.c | ||
| Kconfig | ||
| m25p80.c | ||
| meson.build | ||
| nand.c | ||
| nvme.c | ||
| nvme.h | ||
| onenand.c | ||
| pflash_cfi01.c | ||
| pflash_cfi02.c | ||
| swim.c | ||
| tc58128.c | ||
| trace-events | ||
| trace.h | ||
| vhost-user-blk.c | ||
| virtio-blk.c | ||
| xen-block.c | ||
| xen_blkif.h | ||