From: Alexander Duyck Date: Mon, 20 Jul 2020 17:51:15 +0000 (-0700) Subject: virtio-balloon: Prevent guest from starting a report when we didn't request one X-Git-Tag: qemu-xen-4.14.1^2~20 X-Git-Url: http://xenbits.xensource.com/gitweb?a=commitdiff_plain;h=67808fda375e3a795ae84f3fb19b540f954fa96a;p=qemu-xen.git virtio-balloon: Prevent guest from starting a report when we didn't request one Based on code review it appears possible for the driver to force the device out of a stopped state when hinting by repeating the last ID it was provided. Prevent this by only allowing a transition to the start state when we are in the requested state. This way the driver is only allowed to send one descriptor that will transition the device into the start state. All others will leave it in the stop state once it has finished. Fixes: c13c4153f76d ("virtio-balloon: VIRTIO_BALLOON_F_FREE_PAGE_HINT") Acked-by: David Hildenbrand Signed-off-by: Alexander Duyck Message-Id: <20200720175115.21935.99563.stgit@localhost.localdomain> Cc: qemu-stable@nongnu.org Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin (cherry picked from commit 20a4da0f23078deeff5ea6d1e12f47d968d7c3c9) Signed-off-by: Michael Roth --- diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index e20f90dad4..a30a0c7bfa 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -466,7 +466,8 @@ static bool get_free_page_hints(VirtIOBalloon *dev) ret = false; goto out; } - if (id == dev->free_page_report_cmd_id) { + if (dev->free_page_report_status == FREE_PAGE_REPORT_S_REQUESTED && + id == dev->free_page_report_cmd_id) { dev->free_page_report_status = FREE_PAGE_REPORT_S_START; } else { /*