[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[PULL 14/15] virtio: skip guest index check on device load
From: |
Michael S. Tsirkin |
Subject: |
[PULL 14/15] virtio: skip guest index check on device load |
Date: |
Fri, 30 Oct 2020 10:12:21 -0400 |
From: Felipe Franciosi <felipe@nutanix.com>
QEMU must be careful when loading device state off migration streams to
prevent a malicious source from exploiting the emulator. Overdoing these
checks has the side effect of allowing a guest to "pin itself" in cloud
environments by messing with state which is entirely in its control.
Similarly to what f3081539 achieved in usb_device_post_load(), this
commit removes such a check from virtio_load(). Worth noting, the result
of a load without this check is the same as if a guest enables a VQ with
invalid indexes to begin with. That is, the virtual device is set in a
broken state (by the datapath handler) and must be reset.
Signed-off-by: Felipe Franciosi <felipe@nutanix.com>
Message-Id: <20201028134643.110698-1-felipe@nutanix.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
hw/virtio/virtio.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 6f8f865aff..ceb58fda6c 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -17,6 +17,7 @@
#include "trace.h"
#include "exec/address-spaces.h"
#include "qemu/error-report.h"
+#include "qemu/log.h"
#include "qemu/main-loop.h"
#include "qemu/module.h"
#include "hw/virtio/virtio.h"
@@ -3160,12 +3161,12 @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f, int
version_id)
nheads = vring_avail_idx(&vdev->vq[i]) -
vdev->vq[i].last_avail_idx;
/* Check it isn't doing strange things with descriptor numbers. */
if (nheads > vdev->vq[i].vring.num) {
- error_report("VQ %d size 0x%x Guest index 0x%x "
- "inconsistent with Host index 0x%x: delta 0x%x",
- i, vdev->vq[i].vring.num,
- vring_avail_idx(&vdev->vq[i]),
- vdev->vq[i].last_avail_idx, nheads);
- return -1;
+ qemu_log_mask(LOG_GUEST_ERROR,
+ "VQ %d size 0x%x Guest index 0x%x "
+ "inconsistent with Host index 0x%x: delta 0x%x",
+ i, vdev->vq[i].vring.num,
+ vring_avail_idx(&vdev->vq[i]),
+ vdev->vq[i].last_avail_idx, nheads);
}
vdev->vq[i].used_idx = vring_used_idx(&vdev->vq[i]);
vdev->vq[i].shadow_avail_idx = vring_avail_idx(&vdev->vq[i]);
--
MST
- [PULL 03/15] acpi/crs: Prevent bad ranges for host bridges, (continued)
- [PULL 03/15] acpi/crs: Prevent bad ranges for host bridges, Michael S. Tsirkin, 2020/10/30
- [PULL 06/15] hw/pci: Extract pci_bus_change_irq_level() from pci_change_irq_level(), Michael S. Tsirkin, 2020/10/30
- [PULL 04/15] acpi/crs: Support ranges > 32b for hosts, Michael S. Tsirkin, 2020/10/30
- [PULL 08/15] vhost: Don't special case vq->used_phys in vhost_get_log_size(), Michael S. Tsirkin, 2020/10/30
- [PULL 09/15] pc: Implement -no-hpet as sugar for -machine hpet=on, Michael S. Tsirkin, 2020/10/30
- [PULL 13/15] vhost-blk: set features before setting inflight feature, Michael S. Tsirkin, 2020/10/30
- [PULL 07/15] pci: Assert irqnum is between 0 and bus->nirqs in pci_bus_change_irq_level, Michael S. Tsirkin, 2020/10/30
- [PULL 05/15] hw/virtio/vhost-vdpa: Fix Coverity CID 1432864, Michael S. Tsirkin, 2020/10/30
- [PULL 10/15] pci: advertise a page aligned ATS, Michael S. Tsirkin, 2020/10/30
- [PULL 12/15] pci: Disallow improper BAR registration for type 1, Michael S. Tsirkin, 2020/10/30
- [PULL 14/15] virtio: skip guest index check on device load,
Michael S. Tsirkin <=
- [PULL 11/15] pci: Change error_report to assert(3), Michael S. Tsirkin, 2020/10/30
- [PULL 15/15] intel_iommu: Fix two misuse of "0x%u" prints, Michael S. Tsirkin, 2020/10/30
- Re: [PULL 00/15] pc,pci,vhost,virtio: misc fixes, no-reply, 2020/10/30