Hi, This series is an attempt to fix the DMA re-entrancy problem on the SDHCI device. OSS-Fuzz found it and Alexander generated a helpful reproducer.
By setting the MemTxAttrs::memory bit before doing DMA transactions, the flatview API will return MEMTX_BUS_ERROR if the transaction targets a non-memory (a device), which is usually how DMA-reentrancy bugs are exploited. On real hardware, the checks are on the interconnect bus, not in the SDHCI block. However QEMU blocks aren't modelled that way. Using the flatview API seems (to me) the simplest and closer to hardware, it is a generic API and we can use it to trace bus transactions on all blocks. Note this series is simply one example to fix the generic issues. The important changes are in the previous series: https://lore.kernel.org/qemu-devel/[email protected]/ Based-on: <[email protected]> "physmem: Have flatview API check bus permission from MemTxAttrs" Cc: Mauro Matteo Cascella <[email protected]> Cc: Qiuhao Li <[email protected]> Cc: Peter Xu <[email protected]> Cc: Jason Wang <[email protected]> Cc: David Hildenbrand <[email protected]> Cc: Gerd Hoffmann <[email protected]> Cc: Peter Maydell <[email protected]> Cc: Li Qiang <[email protected]> Cc: Thomas Huth <[email protected]> Cc: Laurent Vivier <[email protected]> Cc: Bandan Das <[email protected]> Cc: Edgar E. Iglesias <[email protected]> Cc: Darren Kenny <[email protected]> Cc: Bin Meng <[email protected]> Cc: Paolo Bonzini <[email protected]> Cc: Alexander Bulekov <[email protected]> Cc: Stefan Hajnoczi <[email protected]> Philippe Mathieu-Daudé (3): hw/sd/sdhci: Honor failed DMA transactions hw/sd/sdhci: Prohibit DMA accesses to devices tests/qtest/fuzz-sdcard-test: Add reproducer for OSS-Fuzz (Issue 29225) hw/sd/sdhci.c | 35 ++++++++++++---- tests/qtest/fuzz-sdcard-test.c | 76 ++++++++++++++++++++++++++++++++++ 2 files changed, 102 insertions(+), 9 deletions(-) -- 2.33.1
