Both virtio-blk and virtio-crypto use destructive iov_discard_front/back() operations on elem->in/out_sg. virtqueue_push() calls dma_memory_unmap() on t= he modified iovec arrays. The memory addresses may not match those originally mapped with dma_memory_map().
This raises several issues: 1. MemoryRegion references can be leaked. 2. Dirty memory may not be tracked. 3. The non-RAM bounce buffer can be leaked. This patch series solves the issue in two ways: 1. virtio-blk uses a new iov_discard_undo() API to restore iovec arrays. 2. virtio-crypto uses g_memdup() to avoid modifying the original iovec arrays. The g_memdup() approach is slower than iov_discard_undo() but less complex/fragile. I am less familiar with the virtio-crypto code and it uses more complex sequences of iov_discard_front/back() calls than virtio-blk. If anyone feels like optimizing virtio-crypto, please go ahead. The virtio-blk bug was found by Alexander Bulekov's fuzzing effort. I found t= he virtio-crypto bug through code inspection. Stefan Hajnoczi (3): util/iov: add iov_discard_undo() virtio-blk: undo destructive iov_discard_*() operations virtio-crypto: don't modify elem->in/out_sg include/hw/virtio/virtio-blk.h | 2 + include/qemu/iov.h | 23 +++++ hw/block/virtio-blk.c | 9 +- hw/virtio/virtio-crypto.c | 17 +++- tests/test-iov.c | 165 +++++++++++++++++++++++++++++++++ util/iov.c | 50 +++++++++- 6 files changed, 257 insertions(+), 9 deletions(-) --=20 2.26.2
