diff options
| author | Dr. David Alan Gilbert <dgilbert@redhat.com> | 2016-12-16 11:41:55 +0000 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2017-01-10 07:02:52 +0200 |
| commit | f2fd57db363e465653efa55102104039b5516759 (patch) | |
| tree | 81070d705842c2c478518a0c97b898d7e1a20759 /hw/virtio/virtio-balloon.c | |
| parent | e66bcc408146730958d1a840bda85d7ad51e0cd7 (diff) | |
| download | qemu-f2fd57db363e465653efa55102104039b5516759.zip | |
balloon: Don't balloon roms
A broken guest can specify physical addresses that correspond
to any memory region, but it shouldn't be able to change ROM.
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Cc: qemu-stable@nongnu.org
Acked-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Diffstat (limited to 'hw/virtio/virtio-balloon.c')
| -rw-r--r-- | hw/virtio/virtio-balloon.c | 7 |
1 files changed, 6 insertions, 1 deletions
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c index 884570a57d..a705e0ec55 100644 --- a/hw/virtio/virtio-balloon.c +++ b/hw/virtio/virtio-balloon.c @@ -228,8 +228,13 @@ static void virtio_balloon_handle_output(VirtIODevice *vdev, VirtQueue *vq) /* FIXME: remove get_system_memory(), but how? */ section = memory_region_find(get_system_memory(), pa, 1); - if (!int128_nz(section.size) || !memory_region_is_ram(section.mr)) + if (!int128_nz(section.size) || + !memory_region_is_ram(section.mr) || + memory_region_is_rom(section.mr) || + memory_region_is_romd(section.mr)) { + trace_virtio_balloon_bad_addr(pa); continue; + } trace_virtio_balloon_handle_output(memory_region_name(section.mr), pa); |