Skip to content
GitLab
    • GitLab: the DevOps platform
    • Explore GitLab
    • Install GitLab
    • How GitLab compares
    • Get started
    • GitLab docs
    • GitLab Learn
  • Pricing
  • Talk to an expert
  • /
  • Help
    • Help
    • Support
    • Community forum
    • Submit feedback
    • Contribute to GitLab
    • Switch to GitLab Next
    Projects Groups Topics Snippets
  • Register
  • Sign in
  • QEMU QEMU
  • Project information
    • Project information
    • Activity
    • Labels
    • Members
  • Repository
    • Repository
    • Files
    • Commits
    • Branches
    • Tags
    • Contributor statistics
    • Graph
    • Compare revisions
    • Locked files
  • Issues 787
    • Issues 787
    • List
    • Boards
    • Service Desk
    • Milestones
    • Iterations
    • Requirements
  • CI/CD
    • CI/CD
    • Pipelines
    • Jobs
    • Artifacts
    • Schedules
    • Test cases
  • Deployments
    • Deployments
    • Environments
    • Releases
  • Packages and registries
    • Packages and registries
    • Package Registry
    • Container Registry
    • Terraform modules
    • Model experiments
  • Monitor
    • Monitor
    • Incidents
  • Analytics
    • Analytics
    • Value stream
    • CI/CD
    • Insights
    • Issue
    • Repository
  • External wiki
    • External wiki
  • Activity
  • Graph
  • Create a new issue
  • Jobs
  • Commits
  • Issue Boards
Collapse sidebar
  • QEMUQEMU
  • QEMUQEMU
  • Issues
  • #556
Closed
Open
Issue created Aug 23, 2021 by Philippe Mathieu-Daudé@philmd_rh

Fix DMA MMIO reentrancy issues

Goal

Find a generic way to fix the DMA reentrancy problem.

Technical details

DMA ring buffer might contains pointers to DMA MMIO region, and once the DMA is programmed it calls itself recursively.

Additional information

List of DMA reentrancy issues (usually found by fuzzer):

  • #62 (closed) (AHCI)
  • #84 (closed), #305 (closed), #552 (closed) (SCSI)
  • #451 (closed), #1282 (closed) (SDHCI)
  • #540 (closed) (xHCI)
  • #541 (closed) (EHCI)
  • #542 (closed) (HDA)
  • #557 (closed) (pcnet)
  • #782 (closed) (NVMe)
  • eepro100
  • #827 (closed) (virtio-blk)
  • #1171 (closed) (tulip)
  • #1543 (closed) (e1000e)
  • #1563 (lsi53c895a)

Usually coredump backtrace includes multiple calls to access_with_adjusted_size() from the Memory API.

Edited Mar 28, 2023 by Thomas Huth
To upload designs, you'll need to enable LFS and have an admin enable hashed storage. More information
Assignee
Assign to
Time tracking