On 17/7/23 18:21, Eric Auger wrote:
In the virtio_iommu_handle_command() when a PROBE request is handled, output_size takes a value greater than the tail size and on a subsequent iteration we can get a stack out-of-band access. Initialize the output_size on each iteration.
A backtrace would be helpful (or reproducer).
The issue was found with ASAN. Credits to: Yiming Tao(Zhejiang University) Gaoning Pan(Zhejiang University) Fixes: 1733eebb9e7 ("virtio-iommu: Implement RESV_MEM probe request") Signed-off-by: Eric Auger <eric.au...@redhat.com> Reported-by: Mauro Matteo Cascella <mcasc...@redhat.com>
Did you mean: Reported-by: Yiming Tao <ta...@zju.edu.cn> ?
Cc: qemu-sta...@nongnu.org --- - added the Cc: qemu-sta...@nongnu.org and copied 2 persons involved in the reporting loop --- hw/virtio/virtio-iommu.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
Reviewed-by: Philippe Mathieu-Daudé <phi...@linaro.org>