virtio-crypto: don't modify elem->in/out_sg
A number of iov_discard_front/back() operations are made by virtio-crypto. The elem->in/out_sg iovec arrays are modified by these operations, resulting virtqueue_unmap_sg() calls on different addresses than were originally mapped. This is problematic because dirty memory may not be logged correctly, MemoryRegion refcounts may be leaked, and the non-RAM bounce buffer can be leaked. Take a copy of the elem->in/out_sg arrays so that the originals are preserved. The iov_discard_undo() API could be used instead (with better performance) but requires careful auditing of the code, so do the simple thing instead. Signed-off-by:Stefan Hajnoczi <stefanha@redhat.com> Reviewed-by:
Li Qiang <liq3ea@gmail.com> Message-Id: <20200917094455.822379-4-stefanha@redhat.com>
Loading
Please register or sign in to comment