diff options
author | Carlos López <clopez@suse.de> | 2023-03-17 01:27:51 +0100 |
---|---|---|
committer | Michael S. Tsirkin <mst@redhat.com> | 2023-04-21 03:08:21 -0400 |
commit | f0d634ea1964ccce317818c44fe299e71007e64d (patch) | |
tree | 2a7aebff170af9990f461d211372c3d49bd0b5a3 /include/hw/virtio/virtio.h | |
parent | c1eb2ddf0f8075faddc5f7c3d39feae3e8e9d6b4 (diff) | |
download | qemu-f0d634ea1964ccce317818c44fe299e71007e64d.zip qemu-f0d634ea1964ccce317818c44fe299e71007e64d.tar.gz qemu-f0d634ea1964ccce317818c44fe299e71007e64d.tar.bz2 |
virtio: refresh vring region cache after updating a virtqueue size
When a virtqueue size is changed by the guest via
virtio_queue_set_num(), its region cache is not automatically updated.
If the size was increased, this could lead to accessing the cache out
of bounds. For example, in vring_get_used_event():
static inline uint16_t vring_get_used_event(VirtQueue *vq)
{
return vring_avail_ring(vq, vq->vring.num);
}
static inline uint16_t vring_avail_ring(VirtQueue *vq, int i)
{
VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
hwaddr pa = offsetof(VRingAvail, ring[i]);
if (!caches) {
return 0;
}
return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
}
vq->vring.num will be greater than caches->avail.len, which will
trigger a failed assertion down the call path of
virtio_lduw_phys_cached().
Fix this by calling virtio_init_region_cache() after
virtio_queue_set_num() if we are not already calling
virtio_queue_set_rings(). In the legacy path this is already done by
virtio_queue_update_rings().
Signed-off-by: Carlos López <clopez@suse.de>
Message-Id: <20230317002749.27379-1-clopez@suse.de>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Acked-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'include/hw/virtio/virtio.h')
-rw-r--r-- | include/hw/virtio/virtio.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h index f236e94..f6b38f7 100644 --- a/include/hw/virtio/virtio.h +++ b/include/hw/virtio/virtio.h @@ -309,6 +309,7 @@ int virtio_get_num_queues(VirtIODevice *vdev); void virtio_queue_set_rings(VirtIODevice *vdev, int n, hwaddr desc, hwaddr avail, hwaddr used); void virtio_queue_update_rings(VirtIODevice *vdev, int n); +void virtio_init_region_cache(VirtIODevice *vdev, int n); void virtio_queue_set_align(VirtIODevice *vdev, int n, int align); void virtio_queue_notify(VirtIODevice *vdev, int n); uint16_t virtio_queue_vector(VirtIODevice *vdev, int n); |