|
From: | Philippe Mathieu-Daudé |
Subject: | Re: [PATCH v7 1/6] memory: prevent dma-reentracy issues |
Date: | Mon, 13 Mar 2023 11:06:36 +0100 |
User-agent: | Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0) Gecko/20100101 Thunderbird/102.8.0 |
On 13/3/23 09:24, Alexander Bulekov wrote:
Add a flag to the DeviceState, when a device is engaged in PIO/MMIO/DMA. This flag is set/checked prior to calling a device's MemoryRegion handlers, and set when device code initiates DMA. The purpose of this flag is to prevent two types of DMA-based reentrancy issues: 1.) mmio -> dma -> mmio case 2.) bh -> dma write -> mmio case These issues have led to problems such as stack-exhaustion and use-after-frees. Summary of the problem from Peter Maydell: https://lore.kernel.org/qemu-devel/CAFEAcA_23vc7hE3iaM-JVA6W38LK4hJoWae5KcknhPRD5fPBZA@mail.gmail.com Resolves: https://gitlab.com/qemu-project/qemu/-/issues/62 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/540 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/541 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/556 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/557 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/827 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1282
BTW we need to commit these reproducers as tests/qtest/fuzz-*.
Reviewed-by: Darren Kenny <darren.kenny@oracle.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Alexander Bulekov <alxndr@bu.edu> Acked-by: Peter Xu <peterx@redhat.com> --- include/hw/qdev-core.h | 7 +++++++ softmmu/memory.c | 17 +++++++++++++++++ softmmu/trace-events | 1 + 3 files changed, 25 insertions(+)
[Prev in Thread] | Current Thread | [Next in Thread] |