From nobody Tue May 21 18:43:37 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zoho.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=yandex-team.ru Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1553260787860198.55299857248963; Fri, 22 Mar 2019 06:19:47 -0700 (PDT) Received: from localhost ([127.0.0.1]:57314 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h7K5I-00009B-A3 for importer@patchew.org; Fri, 22 Mar 2019 09:19:44 -0400 Received: from eggs.gnu.org ([209.51.188.92]:53790) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h7K26-0006mb-18 for qemu-devel@nongnu.org; Fri, 22 Mar 2019 09:16:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1h7JoF-0004gP-JF for qemu-devel@nongnu.org; Fri, 22 Mar 2019 09:02:09 -0400 Received: from forwardcorp1j.cmail.yandex.net ([5.255.227.105]:59870) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1h7JoE-0004c3-83 for qemu-devel@nongnu.org; Fri, 22 Mar 2019 09:02:07 -0400 Received: from mxbackcorp2j.mail.yandex.net (mxbackcorp2j.mail.yandex.net [IPv6:2a02:6b8:0:1619::119]) by forwardcorp1j.cmail.yandex.net (Yandex) with ESMTP id B9C5820F59; Fri, 22 Mar 2019 16:02:01 +0300 (MSK) Received: from smtpcorp1o.mail.yandex.net (smtpcorp1o.mail.yandex.net [2a02:6b8:0:1a2d::30]) by mxbackcorp2j.mail.yandex.net (nwsmtp/Yandex) with ESMTP id B69cAn8Ec9-20BeavjL; Fri, 22 Mar 2019 16:02:01 +0300 Received: from dynamic-vpn.dhcp.yndx.net (dynamic-vpn.dhcp.yndx.net [2a02:6b8:0:3715::1:82]) by smtpcorp1o.mail.yandex.net (nwsmtp/Yandex) with ESMTPSA id 2seceg5Sbc-20LC3bvg; Fri, 22 Mar 2019 16:02:00 +0300 (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (Client certificate not present) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yandex-team.ru; s=default; t=1553259721; bh=of0AuMJsOL26vdp3TuQh/+9fFJCo4d7pTSvKDmS6rHI=; h=Message-ID:Subject:To:From:Date:Cc; b=P2+8+uqUc0+JYc/Sh9wh4C+jbS3FK9aY+nt9To41toxQo+AyqCD3+SXgJxrQTyV3K i7YQxuOW5LMyXmqEiIdsOwiH2GuedrmQJAmfLaDsG9K4bLHMzy+9oxIdAqA5q+RnT2 HqcEhhIJkVAmUcaMGdqXXZQc9vqFO2Ge+X1cK758= Authentication-Results: mxbackcorp2j.mail.yandex.net; dkim=pass header.i=@yandex-team.ru Date: Fri, 22 Mar 2019 16:01:59 +0300 From: Dima Stepanov To: qemu-devel@nongnu.org Message-ID: <20190322130158.GA29843@dimastep-nix> MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 5.255.227.105 Subject: [Qemu-devel] [PATCH v1] exec: check the range in the address_space_unmap routine X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.21 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Paolo Bonzini , "Yakovlev, Evgeny" , Stefan Hajnoczi , Richard Henderson Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" In case of the virtio-blk communication, can get the following assertion for the specifically crafted virtio packet: qemu-system-x86_64: exec.c:3725: address_space_unmap: Assertion `mr !=3D NULL' failed. This assertion is triggered if the length of the first descriptor in the block request chain (block command descriptor) is more than block command size. In this case the hw/block/virtio-blk.c:virtio_blk_handle_request() routine calls the iov_discard_front() function and the iov base and size are changed. As a result the address can not be found during the address_space_unmap() call. The fix is to check the whole address range in the address_space_unmap function. Signed-off-by: Dima Stepanov --- exec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/exec.c b/exec.c index 86a38d3..0eeb018 100644 --- a/exec.c +++ b/exec.c @@ -3717,7 +3717,7 @@ void *address_space_map(AddressSpace *as, void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len, int is_write, hwaddr access_len) { - if (buffer !=3D bounce.buffer) { + if ((buffer < bounce.buffer) || (buffer + access_len > bounce.buffer += bounce.len)) { MemoryRegion *mr; ram_addr_t addr1; =20 --=20 2.7.4