Re: [PATCH-for-9.0 3/4] hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs

[Michael S. Tsirkin]

On Mon, Apr 08, 2024 at 09:14:39AM +0200, Philippe Mathieu-Daudé wrote:
> On 4/4/24 21:13, Philippe Mathieu-Daudé wrote:
> > Replace qemu_bh_new_guarded() by virtio_bh_new_guarded()
> > so the bus and device use the same guard. Otherwise the
> > DMA-reentrancy protection can be bypassed.
> > 
> > Cc: qemu-stable@nongnu.org
> > Suggested-by: Alexander Bulekov <alxndr@bu.edu>
> > Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
> > ---
> >   hw/char/virtio-serial-bus.c | 3 +--
> >   1 file changed, 1 insertion(+), 2 deletions(-)
> > 
> > diff --git a/hw/char/virtio-serial-bus.c b/hw/char/virtio-serial-bus.c
> > index 016aba6374..cd0e3a11f7 100644
> > --- a/hw/char/virtio-serial-bus.c
> > +++ b/hw/char/virtio-serial-bus.c
> > @@ -985,8 +985,7 @@ static void virtser_port_device_realize(DeviceState 
> > *dev, Error **errp)
> >           return;
> >       }
> > -    port->bh = qemu_bh_new_guarded(flush_queued_data_bh, port,
> > -                                   &dev->mem_reentrancy_guard);
> > +    port->bh = virtio_bh_new_guarded(vdev, flush_queued_data_bh, port);
> 
> Missing:
> -- >8 --
> -    port->bh = virtio_bh_new_guarded(vdev, flush_queued_data_bh, port);
> +    port->bh = virtio_bh_new_guarded(VIRTIO_DEVICE(dev),
> +                                     flush_queued_data_bh, port);
> ---

I don't get it. vdev is already the correct type. Why do you need
VIRTIO_DEVICE here?

> >       port->elem = NULL;
> >   }