mbox series

[PATCH-for-9.0,v2,0/4] hw/virtio: Protect from more DMA re-entrancy bugs

Message ID 20240409105537.18308-1-philmd@linaro.org
Headers show
Series hw/virtio: Protect from more DMA re-entrancy bugs | expand

Message

Philippe Mathieu-Daudé April 9, 2024, 10:55 a.m. UTC 
Fixes for CVE-2024-3446.

Gerd suggested to use the transport guard to protect the
device from DMA re-entrancy abuses.

Since v1:
- Take a DeviceState argument, not VirtIODevice, so it
  works seamlessly with CCW devices (actually the original
  code from Gerd).
- Build and test :>

I'll send a PR with these patches later today.

Regards,

Phil.

Philippe Mathieu-Daudé (4):
  hw/virtio: Introduce virtio_bh_new_guarded() helper
  hw/display/virtio-gpu: Protect from DMA re-entrancy bugs
  hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs
  hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs

 include/hw/virtio/virtio.h  |  7 +++++++
 hw/char/virtio-serial-bus.c |  3 +--
 hw/display/virtio-gpu.c     |  6 ++----
 hw/virtio/virtio-crypto.c   |  4 ++--
 hw/virtio/virtio.c          | 10 ++++++++++
 5 files changed, 22 insertions(+), 8 deletions(-)

Comments

Michael S. Tsirkin April 9, 2024, 11:33 a.m. UTC | #1 
On Tue, Apr 09, 2024 at 12:55:33PM +0200, Philippe Mathieu-Daudé wrote:
> Fixes for CVE-2024-3446.
> 
> Gerd suggested to use the transport guard to protect the
> device from DMA re-entrancy abuses.
> 
> Since v1:
> - Take a DeviceState argument, not VirtIODevice, so it
>   works seamlessly with CCW devices (actually the original
>   code from Gerd).
> - Build and test :>
> 
> I'll send a PR with these patches later today.

I reviewed these too now

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

> Regards,
> 
> Phil.
> 
> Philippe Mathieu-Daudé (4):
>   hw/virtio: Introduce virtio_bh_new_guarded() helper
>   hw/display/virtio-gpu: Protect from DMA re-entrancy bugs
>   hw/char/virtio-serial-bus: Protect from DMA re-entrancy bugs
>   hw/virtio/virtio-crypto: Protect from DMA re-entrancy bugs
> 
>  include/hw/virtio/virtio.h  |  7 +++++++
>  hw/char/virtio-serial-bus.c |  3 +--
>  hw/display/virtio-gpu.c     |  6 ++----
>  hw/virtio/virtio-crypto.c   |  4 ++--
>  hw/virtio/virtio.c          | 10 ++++++++++
>  5 files changed, 22 insertions(+), 8 deletions(-)
> 
> -- 
> 2.41.0
Philippe Mathieu-Daudé April 9, 2024, 2:35 p.m. UTC | #2 
On 9/4/24 13:33, Michael S. Tsirkin wrote:
> On Tue, Apr 09, 2024 at 12:55:33PM +0200, Philippe Mathieu-Daudé wrote:
>> Fixes for CVE-2024-3446.
>>
>> Gerd suggested to use the transport guard to protect the
>> device from DMA re-entrancy abuses.
>>
>> Since v1:
>> - Take a DeviceState argument, not VirtIODevice, so it
>>    works seamlessly with CCW devices (actually the original
>>    code from Gerd).
>> - Build and test :>
>>
>> I'll send a PR with these patches later today.
> 
> I reviewed these too now
> 
> Reviewed-by: Michael S. Tsirkin <mst@redhat.com>

Thanks, series queued.