From nobody Wed May 8 09:04:10 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) client-ip=208.118.235.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zoho.com; spf=pass (zoho.com: domain of gnu.org designates 208.118.235.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; Return-Path: Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) by mx.zohomail.com with SMTPS id 1488296990734469.579286712574; Tue, 28 Feb 2017 07:49:50 -0800 (PST) Received: from localhost ([::1]:34556 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cik28-000702-CP for importer@patchew.org; Tue, 28 Feb 2017 10:49:48 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:57859) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cijdW-0001li-GV for qemu-devel@nongnu.org; Tue, 28 Feb 2017 10:24:23 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cijdT-0008UR-79 for qemu-devel@nongnu.org; Tue, 28 Feb 2017 10:24:22 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:45027) by eggs.gnu.org with esmtps (TLS1.0:RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cijdS-0008U1-Ut for qemu-devel@nongnu.org; Tue, 28 Feb 2017 10:24:19 -0500 Received: from pps.filterd (m0098404.ppops.net [127.0.0.1]) by mx0a-001b2d01.pphosted.com (8.16.0.20/8.16.0.20) with SMTP id v1SFJnDY083404 for ; Tue, 28 Feb 2017 10:24:17 -0500 Received: from e06smtp15.uk.ibm.com (e06smtp15.uk.ibm.com [195.75.94.111]) by mx0a-001b2d01.pphosted.com with ESMTP id 28w1xpceym-1 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=NOT) for ; Tue, 28 Feb 2017 10:24:17 -0500 Received: from localhost by e06smtp15.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 28 Feb 2017 15:24:14 -0000 Received: from d06dlp01.portsmouth.uk.ibm.com (9.149.20.13) by e06smtp15.uk.ibm.com (192.168.101.145) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Tue, 28 Feb 2017 15:24:13 -0000 Received: from b06cxnps3074.portsmouth.uk.ibm.com (d06relay09.portsmouth.uk.ibm.com [9.149.109.194]) by d06dlp01.portsmouth.uk.ibm.com (Postfix) with ESMTP id 0F86517D805A; Tue, 28 Feb 2017 15:27:26 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (mk.ibm.com [9.149.105.60]) by b06cxnps3074.portsmouth.uk.ibm.com (8.14.9/8.14.9/NCO v10.0) with ESMTP id v1SFOCIQ11731374; Tue, 28 Feb 2017 15:24:12 GMT Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id C1EE842063; Tue, 28 Feb 2017 15:24:07 +0000 (GMT) Received: from d06av24.portsmouth.uk.ibm.com (unknown [127.0.0.1]) by IMSVA (Postfix) with ESMTP id 8E39942057; Tue, 28 Feb 2017 15:24:07 +0000 (GMT) Received: from tuxmaker.boeblingen.de.ibm.com (unknown [9.152.85.9]) by d06av24.portsmouth.uk.ibm.com (Postfix) with ESMTPS; Tue, 28 Feb 2017 15:24:07 +0000 (GMT) From: Cornelia Huck To: qemu-devel@nongnu.org Date: Tue, 28 Feb 2017 16:24:11 +0100 X-Mailer: git-send-email 2.8.4 X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17022815-0020-0000-0000-0000031211DC X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17022815-0021-0000-0000-000040924A51 Message-Id: <20170228152411.81609-1-cornelia.huck@de.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:, , definitions=2017-02-28_14:, , signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1612050000 definitions=main-1702280141 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 3.x [generic] [fuzzy] X-Received-From: 148.163.156.1 Subject: [Qemu-devel] [PATCH] virtio: guard vring access when setting notification X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Cornelia Huck , pbonzini@redhat.com, borntraeger@de.ibm.com, mst@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail: RSF_0 Z_629925259 SPT_0 Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Switching to vring caches exposed an existing bug in virtio_queue_set_notification(): We can't access vring structures if they have not been set up yet. This may happen, for example, for virtio-blk devices with multiple queues: The code will try to switch notifiers for every queue, but the guest may have only set up a subset of them. Fix this by (1) guarding access to the vring memory by checking for vring.desc and (2) triggering an update to the vring flags for consistency with the configured notification state once the queue is actually configured. Signed-off-by: Cornelia Huck Reviewed-by: Paolo Bonzini Tested-by: Christian Borntraeger --- hw/virtio/virtio.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c index e487e36..d2ecd64 100644 --- a/hw/virtio/virtio.c +++ b/hw/virtio/virtio.c @@ -284,10 +284,11 @@ static inline void vring_set_avail_event(VirtQueue *v= q, uint16_t val) virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val); } =20 -void virtio_queue_set_notification(VirtQueue *vq, int enable) +static void vring_set_notification(VirtQueue *vq, int enable) { - vq->notification =3D enable; - + if (!vq->vring.desc) { + return; + } rcu_read_lock(); if (virtio_vdev_has_feature(vq->vdev, VIRTIO_RING_F_EVENT_IDX)) { vring_set_avail_event(vq, vring_avail_idx(vq)); @@ -303,6 +304,13 @@ void virtio_queue_set_notification(VirtQueue *vq, int = enable) rcu_read_unlock(); } =20 +void virtio_queue_set_notification(VirtQueue *vq, int enable) +{ + vq->notification =3D enable; + + vring_set_notification(vq, enable); +} + int virtio_queue_ready(VirtQueue *vq) { return vq->vring.avail !=3D 0; @@ -1348,6 +1356,7 @@ void virtio_queue_set_addr(VirtIODevice *vdev, int n,= hwaddr addr) { vdev->vq[n].vring.desc =3D addr; virtio_queue_update_rings(vdev, n); + vring_set_notification(&vdev->vq[n], vdev->vq[n].notification); } =20 hwaddr virtio_queue_get_addr(VirtIODevice *vdev, int n) @@ -1362,6 +1371,7 @@ void virtio_queue_set_rings(VirtIODevice *vdev, int n= , hwaddr desc, vdev->vq[n].vring.avail =3D avail; vdev->vq[n].vring.used =3D used; virtio_init_region_cache(vdev, n); + vring_set_notification(&vdev->vq[n], vdev->vq[n].notification); } =20 void virtio_queue_set_num(VirtIODevice *vdev, int n, int num) --=20 2.8.4