Re: [PULL 01/31] virtio: refresh vring region cache after updating a virtqueue size

[Michael Tokarev]

25.04.2023 10:44, Michael S. Tsirkin wrote:

From: Carlos López <clo...@suse.de>

When a virtqueue size is changed by the guest via
virtio_queue_set_num(), its region cache is not automatically updated.
If the size was increased, this could lead to accessing the cache out
of bounds. For example, in vring_get_used_event():

     static inline uint16_t vring_get_used_event(VirtQueue *vq)
     {
         return vring_avail_ring(vq, vq->vring.num);
     }

     static inline uint16_t vring_avail_ring(VirtQueue *vq, int i)
     {
         VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
         hwaddr pa = offsetof(VRingAvail, ring[i]);

         if (!caches) {
             return 0;
         }

         return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
     }

vq->vring.num will be greater than caches->avail.len, which will
trigger a failed assertion down the call path of
virtio_lduw_phys_cached().

Is it not a stable-8.0 material?
Michael, you dropped this patch from your previous pullreq
for v8.0 already before..

/mjt