Hi, This series is an attempt to fix the DMA re-entrancy problem on the SDHCI device. OSS-Fuzz found it and Alexander generated a helpful reproducer.
By setting the MemTxAttrs::memory bit before doing DMA transactions, the flatview API will return MEMTX_BUS_ERROR if the transaction targets a non-memory (a device), which is usually how DMA-reentrancy bugs are exploited. On real hardware, the checks are on the interconnect bus, not in the SDHCI block. However QEMU blocks aren't modelled that way. Using the flatview API seems (to me) the simplest and closer to hardware, it is a generic API and we can use it to trace bus transactions on all blocks. Note this series is simply one example to fix the generic issues. The important changes are in the previous series: https://lore.kernel.org/qemu-devel/20211215182421.418374-1-phi...@redhat.com/ Based-on: <20211215182421.418374-1-phi...@redhat.com> "physmem: Have flatview API check bus permission from MemTxAttrs" Cc: Mauro Matteo Cascella <mcasc...@redhat.com> Cc: Qiuhao Li <qiuhao...@outlook.com> Cc: Peter Xu <pet...@redhat.com> Cc: Jason Wang <jasow...@redhat.com> Cc: David Hildenbrand <da...@redhat.com> Cc: Gerd Hoffmann <kra...@redhat.com> Cc: Peter Maydell <peter.mayd...@linaro.org> Cc: Li Qiang <liq...@gmail.com> Cc: Thomas Huth <th...@redhat.com> Cc: Laurent Vivier <lviv...@redhat.com> Cc: Bandan Das <b...@redhat.com> Cc: Edgar E. Iglesias <edgar.igles...@gmail.com> Cc: Darren Kenny <darren.ke...@oracle.com> Cc: Bin Meng <bin.m...@windriver.com> Cc: Paolo Bonzini <pbonz...@redhat.com> Cc: Alexander Bulekov <alx...@bu.edu> Cc: Stefan Hajnoczi <stefa...@redhat.com> Philippe Mathieu-Daudé (3): hw/sd/sdhci: Honor failed DMA transactions hw/sd/sdhci: Prohibit DMA accesses to devices tests/qtest/fuzz-sdcard-test: Add reproducer for OSS-Fuzz (Issue 29225) hw/sd/sdhci.c | 35 ++++++++++++---- tests/qtest/fuzz-sdcard-test.c | 76 ++++++++++++++++++++++++++++++++++ 2 files changed, 102 insertions(+), 9 deletions(-) -- 2.33.1
