hw/virtio/virtio-iommu: Reject inverted MAP range

[PATCH] hw/virtio/virtio-iommu: Reject inverted MAP range

Bin Guo posted 1 patch 1 month, 3 weeks ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20260803094302.95228-1-guobin@linux.alibaba.com

Maintainers: Eric Auger <eric.auger@redhat.com>, "Michael S. Tsirkin" <mst@redhat.com>

hw/virtio/virtio-iommu.c | 4 ++++
1 file changed, 4 insertions(+)

Expand all Fold all

[PATCH] hw/virtio/virtio-iommu: Reject inverted MAP range

Posted by Bin Guo 1 month, 3 weeks ago

virtio_iommu_map() did not check that virt_end >= virt_start.  An
inverted range corrupts the GTree comparator contract (interval_cmp
returns non-zero for a key compared with itself), causing an infinite
loop in virtio_iommu_unmap() while holding s->mutex.

Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4104
Cc: qemu-stable@nongnu.org
Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
---
 hw/virtio/virtio-iommu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
index 533bd5073f..cc863e90d2 100644
--- a/hw/virtio/virtio-iommu.c
+++ b/hw/virtio/virtio-iommu.c
@@ -807,6 +807,10 @@ static int virtio_iommu_map(VirtIOIOMMU *s,
         return VIRTIO_IOMMU_S_INVAL;
     }
 
+    if (virt_end < virt_start) {
+        return VIRTIO_IOMMU_S_INVAL;
+    }
+
     domain = g_tree_lookup(s->domains, GUINT_TO_POINTER(domain_id));
     if (!domain) {
         return VIRTIO_IOMMU_S_NOENT;
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] hw/virtio/virtio-iommu: Reject inverted MAP range

Posted by Michael S. Tsirkin 1 month, 3 weeks ago

On Mon, Aug 03, 2026 at 05:43:02PM +0800, Bin Guo wrote:
> virtio_iommu_map() did not check that virt_end >= virt_start.  An
> inverted range corrupts the GTree comparator contract (interval_cmp
> returns non-zero for a key compared with itself), causing an infinite
> loop in virtio_iommu_unmap() while holding s->mutex.
> 
> Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4104
> Cc: qemu-stable@nongnu.org
> Signed-off-by: Bin Guo <guobin@linux.alibaba.com>

Same as 20260729131953.1720567-1-physicalmtea@gmail.com ?

> ---
>  hw/virtio/virtio-iommu.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/hw/virtio/virtio-iommu.c b/hw/virtio/virtio-iommu.c
> index 533bd5073f..cc863e90d2 100644
> --- a/hw/virtio/virtio-iommu.c
> +++ b/hw/virtio/virtio-iommu.c
> @@ -807,6 +807,10 @@ static int virtio_iommu_map(VirtIOIOMMU *s,
>          return VIRTIO_IOMMU_S_INVAL;
>      }
>  
> +    if (virt_end < virt_start) {
> +        return VIRTIO_IOMMU_S_INVAL;
> +    }
> +
>      domain = g_tree_lookup(s->domains, GUINT_TO_POINTER(domain_id));
>      if (!domain) {
>          return VIRTIO_IOMMU_S_NOENT;
> -- 
> 2.50.1 (Apple Git-155)