Fix crashes with CAN bus and ISA DMA devices

[Qemu-devel] [PATCH for-2.12 0/4] Fix crashes with CAN bus and ISA DMA devices

Posted by Thomas Huth 7 years, 7 months ago

The new CAN bus devices and some older ISA devices that use DMA can be
used to crash QEMU. These patches introduce some proper checks so that
the users get a proper error message instead.

Alexey Kardashevskiy (1):
  fdc: Exit if ISA controller does not support DMA

Thomas Huth (3):
  hw/net/can: Fix segfaults when using the devices without bus
  hw/audio: Fix crashes when devices are used on ISA bus without DMA
  scripts/device-crash-test: Remove fixed isapc-with-iommu entry

 hw/audio/cs4231a.c        | 8 +++++++-
 hw/audio/gus.c            | 7 ++++++-
 hw/audio/sb16.c           | 9 +++++++--
 hw/block/fdc.c            | 5 ++++-
 hw/net/can/can_sja1000.c  | 4 ++++
 scripts/device-crash-test | 8 --------
 6 files changed, 28 insertions(+), 13 deletions(-)

-- 
1.8.3.1

Re: [Qemu-devel] [PATCH for-2.12 0/4] Fix crashes with CAN bus and ISA DMA devices

Posted by Paolo Bonzini 7 years, 7 months ago

On 16/03/2018 10:51, Thomas Huth wrote:
> The new CAN bus devices and some older ISA devices that use DMA can be
> used to crash QEMU. These patches introduce some proper checks so that
> the users get a proper error message instead.
> 
> Alexey Kardashevskiy (1):
>   fdc: Exit if ISA controller does not support DMA
> 
> Thomas Huth (3):
>   hw/net/can: Fix segfaults when using the devices without bus
>   hw/audio: Fix crashes when devices are used on ISA bus without DMA
>   scripts/device-crash-test: Remove fixed isapc-with-iommu entry
> 
>  hw/audio/cs4231a.c        | 8 +++++++-
>  hw/audio/gus.c            | 7 ++++++-
>  hw/audio/sb16.c           | 9 +++++++--
>  hw/block/fdc.c            | 5 ++++-
>  hw/net/can/can_sja1000.c  | 4 ++++
>  scripts/device-crash-test | 8 --------
>  6 files changed, 28 insertions(+), 13 deletions(-)
> 

Queued, thanks.

Paolo

Re: [Qemu-devel] [PATCH for-2.12 0/4] Fix crashes with CAN bus and ISA DMA devices

Posted by John Snow 7 years, 7 months ago


On 03/16/2018 06:15 AM, Paolo Bonzini wrote:
> On 16/03/2018 10:51, Thomas Huth wrote:
>> The new CAN bus devices and some older ISA devices that use DMA can be
>> used to crash QEMU. These patches introduce some proper checks so that
>> the users get a proper error message instead.
>>
>> Alexey Kardashevskiy (1):
>>   fdc: Exit if ISA controller does not support DMA
>>
>> Thomas Huth (3):
>>   hw/net/can: Fix segfaults when using the devices without bus
>>   hw/audio: Fix crashes when devices are used on ISA bus without DMA
>>   scripts/device-crash-test: Remove fixed isapc-with-iommu entry
>>
>>  hw/audio/cs4231a.c        | 8 +++++++-
>>  hw/audio/gus.c            | 7 ++++++-
>>  hw/audio/sb16.c           | 9 +++++++--
>>  hw/block/fdc.c            | 5 ++++-
>>  hw/net/can/can_sja1000.c  | 4 ++++
>>  scripts/device-crash-test | 8 --------
>>  6 files changed, 28 insertions(+), 13 deletions(-)
>>
> 
> Queued, thanks.
> 
> Paolo
> 

Did you not actually send a PR for this?

Re: [Qemu-devel] [PATCH for-2.12 0/4] Fix crashes with CAN bus and ISA DMA devices

Posted by Paolo Bonzini 7 years, 7 months ago

On 23/03/2018 19:20, John Snow wrote:
> 
> 
> On 03/16/2018 06:15 AM, Paolo Bonzini wrote:
>> On 16/03/2018 10:51, Thomas Huth wrote:
>>> The new CAN bus devices and some older ISA devices that use DMA can be
>>> used to crash QEMU. These patches introduce some proper checks so that
>>> the users get a proper error message instead.
>>>
>>> Alexey Kardashevskiy (1):
>>>   fdc: Exit if ISA controller does not support DMA
>>>
>>> Thomas Huth (3):
>>>   hw/net/can: Fix segfaults when using the devices without bus
>>>   hw/audio: Fix crashes when devices are used on ISA bus without DMA
>>>   scripts/device-crash-test: Remove fixed isapc-with-iommu entry
>>>
>>>  hw/audio/cs4231a.c        | 8 +++++++-
>>>  hw/audio/gus.c            | 7 ++++++-
>>>  hw/audio/sb16.c           | 9 +++++++--
>>>  hw/block/fdc.c            | 5 ++++-
>>>  hw/net/can/can_sja1000.c  | 4 ++++
>>>  scripts/device-crash-test | 8 --------
>>>  6 files changed, 28 insertions(+), 13 deletions(-)
>>>
>>
>> Queued, thanks.
>>
>> Paolo
>>
> 
> Did you not actually send a PR for this?

No, today. :)

Paolo