From 7bd04a041addcdef6a03e6498aafaea55ca6e88b Mon Sep 17 00:00:00 2001 From: Stefan Hajnoczi Date: Thu, 17 Sep 2020 10:44:54 +0100 Subject: virtio-blk: undo destructive iov_discard_*() operations Fuzzing discovered that virtqueue_unmap_sg() is being called on modified req->in/out_sg iovecs. This means dma_memory_map() and dma_memory_unmap() calls do not have matching memory addresses. Fuzzing discovered that non-RAM addresses trigger a bug: void address_space_unmap(AddressSpace *as, void *buffer, hwaddr len, bool is_write, hwaddr access_len) { if (buffer != bounce.buffer) { ^^^^^^^^^^^^^^^^^^^^^^^ A modified iov->iov_base is no longer recognized as a bounce buffer and the wrong branch is taken. There are more potential bugs: dirty memory is not tracked correctly and MemoryRegion refcounts can be leaked. Use the new iov_discard_undo() API to restore elem->in/out_sg before virtqueue_push() is called. Fixes: 827805a2492c1bbf1c0712ed18ee069b4ebf3dd6 ("virtio-blk: Convert VirtIOBlockReq.out to structrue") Reported-by: Alexander Bulekov Signed-off-by: Stefan Hajnoczi Reviewed-by: Li Qiang Buglink: https://bugs.launchpad.net/qemu/+bug/1890360 Message-Id: <20200917094455.822379-3-stefanha@redhat.com> --- include/hw/virtio/virtio-blk.h | 2 ++ 1 file changed, 2 insertions(+) (limited to 'include/hw/virtio') diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h index 5953cf8961..214ab74822 100644 --- a/include/hw/virtio/virtio-blk.h +++ b/include/hw/virtio/virtio-blk.h @@ -70,6 +70,8 @@ typedef struct VirtIOBlockReq { int64_t sector_num; VirtIOBlock *dev; VirtQueue *vq; + IOVDiscardUndo inhdr_undo; + IOVDiscardUndo outhdr_undo; struct virtio_blk_inhdr *in; struct virtio_blk_outhdr out; QEMUIOVector qiov; -- cgit v1.2.3-55-g7522