[qemu-xen stable-4.15] xen-mapcache: Avoid entry->lock overflow

[patchbot@xxxxxxx]

commit 6503bd6a1b5364ffd346a8a475e1eb91b9f756e5
Author:     Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
AuthorDate: Mon Jan 24 10:44:50 2022 +0000
Commit:     Anthony PERARD <anthony.perard@xxxxxxxxxx>
CommitDate: Thu Mar 17 10:52:15 2022 +0000

    xen-mapcache: Avoid entry->lock overflow
    
    In some cases, a particular mapcache entry may be mapped 256 times
    causing the lock field to wrap to 0. For example, this may happen when
    using emulated NVME and the guest submits a large scatter-gather write.
    At this point, the entry map be remapped causing QEMU to write the wrong
    data or crash (since remap is not atomic).
    
    Avoid this overflow by increasing the lock field to a uint32_t and also
    detect it and abort rather than continuing regardless.
    
    Signed-off-by: Ross Lagerwall <ross.lagerwall@xxxxxxxxxx>
    Reviewed-by: Paul Durrant <paul@xxxxxxx>
    Reviewed-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
    Message-Id: <20220124104450.152481-1-ross.lagerwall@xxxxxxxxxx>
    Signed-off-by: Anthony PERARD <anthony.perard@xxxxxxxxxx>
    (cherry picked from commit a021a2dd8b790437d27db95774969349632f856a)
---
 hw/i386/xen/xen-mapcache.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/i386/xen/xen-mapcache.c b/hw/i386/xen/xen-mapcache.c
index 5b120ed44b..c66f582da1 100644
--- a/hw/i386/xen/xen-mapcache.c
+++ b/hw/i386/xen/xen-mapcache.c
@@ -52,7 +52,7 @@ typedef struct MapCacheEntry {
     hwaddr paddr_index;
     uint8_t *vaddr_base;
     unsigned long *valid_mapping;
-    uint8_t lock;
+    uint32_t lock;
 #define XEN_MAPCACHE_ENTRY_DUMMY (1 << 0)
     uint8_t flags;
     hwaddr size;
@@ -341,6 +341,12 @@ tryagain:
     if (lock) {
         MapCacheRev *reventry = g_malloc0(sizeof(MapCacheRev));
         entry->lock++;
+        if (entry->lock == 0) {
+            fprintf(stderr,
+                    "mapcache entry lock overflow: "TARGET_FMT_plx" -> %p\n",
+                    entry->paddr_index, entry->vaddr_base);
+            abort();
+        }
         reventry->dma = dma;
         reventry->vaddr_req = mapcache->last_entry->vaddr_base + 
address_offset;
         reventry->paddr_index = mapcache->last_entry->paddr_index;
--
generated by git-patchbot for /home/xen/git/qemu-xen.git#stable-4.15