mirror of https://github.com/proxmox/mirror_qemu
c40ca2301c
Add a flag to the DeviceState, when a device is engaged in PIO/MMIO/DMA.
This flag is set/checked prior to calling a device's MemoryRegion
handlers, and set when device code initiates DMA. The purpose of this
flag is to prevent two types of DMA-based reentrancy issues:
1.) mmio -> dma -> mmio case
2.) bh -> dma write -> mmio case
These issues have led to problems such as stack-exhaustion and
use-after-frees.
Summary of the problem from Peter Maydell:
https://lore.kernel.org/qemu-devel/CAFEAcA_23vc7hE3iaM-JVA6W38LK4hJoWae5KcknhPRD5fPBZA@mail.gmail.com
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/62
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/540
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/541
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/556
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/557
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/827
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1282
Resolves: CVE-2023-0330
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20230427211013.2994127-2-alxndr@bu.edu>
[thuth: Replace warn_report() with warn_report_once()]
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit
|
||
|---|---|---|
| .. | ||
| user | ||
| address-spaces.h | ||
| confidential-guest-support.h | ||
| cpu-all.h | ||
| cpu-common.h | ||
| cpu-defs.h | ||
| cpu_ldst.h | ||
| cputlb.h | ||
| exec-all.h | ||
| gdbstub.h | ||
| gen-icount.h | ||
| helper-gen.h | ||
| helper-head.h | ||
| helper-proto.h | ||
| helper-tcg.h | ||
| hwaddr.h | ||
| ioport.h | ||
| log.h | ||
| memattrs.h | ||
| memop.h | ||
| memopidx.h | ||
| memory-internal.h | ||
| memory.h | ||
| memory_ldst.h.inc | ||
| memory_ldst_cached.h.inc | ||
| memory_ldst_phys.h.inc | ||
| page-vary.h | ||
| plugin-gen.h | ||
| poison.h | ||
| ram_addr.h | ||
| ramblock.h | ||
| ramlist.h | ||
| target_page.h | ||
| translate-all.h | ||
| translator.h | ||