)]}'
{
  "commit": "f0d634ea1964ccce317818c44fe299e71007e64d",
  "tree": "2a7aebff170af9990f461d211372c3d49bd0b5a3",
  "parents": [
    "c1eb2ddf0f8075faddc5f7c3d39feae3e8e9d6b4"
  ],
  "author": {
    "name": "Carlos López",
    "email": "clopez@suse.de",
    "time": "Fri Mar 17 01:27:51 2023 +0100"
  },
  "committer": {
    "name": "Michael S. Tsirkin",
    "email": "mst@redhat.com",
    "time": "Fri Apr 21 03:08:21 2023 -0400"
  },
  "message": "virtio: refresh vring region cache after updating a virtqueue size\n\nWhen a virtqueue size is changed by the guest via\nvirtio_queue_set_num(), its region cache is not automatically updated.\nIf the size was increased, this could lead to accessing the cache out\nof bounds. For example, in vring_get_used_event():\n\n    static inline uint16_t vring_get_used_event(VirtQueue *vq)\n    {\n        return vring_avail_ring(vq, vq-\u003evring.num);\n    }\n\n    static inline uint16_t vring_avail_ring(VirtQueue *vq, int i)\n    {\n        VRingMemoryRegionCaches *caches \u003d vring_get_region_caches(vq);\n        hwaddr pa \u003d offsetof(VRingAvail, ring[i]);\n\n        if (!caches) {\n            return 0;\n        }\n\n        return virtio_lduw_phys_cached(vq-\u003evdev, \u0026caches-\u003eavail, pa);\n    }\n\nvq-\u003evring.num will be greater than caches-\u003eavail.len, which will\ntrigger a failed assertion down the call path of\nvirtio_lduw_phys_cached().\n\nFix this by calling virtio_init_region_cache() after\nvirtio_queue_set_num() if we are not already calling\nvirtio_queue_set_rings(). In the legacy path this is already done by\nvirtio_queue_update_rings().\n\nSigned-off-by: Carlos López \u003cclopez@suse.de\u003e\nMessage-Id: \u003c20230317002749.27379-1-clopez@suse.de\u003e\nReviewed-by: Cornelia Huck \u003ccohuck@redhat.com\u003e\nAcked-by: Halil Pasic \u003cpasic@linux.ibm.com\u003e\nReviewed-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e33e5207ab8dec6ef66e08b7648df09d490da2a2",
      "old_mode": 33188,
      "old_path": "hw/s390x/virtio-ccw.c",
      "new_id": "f44de1a8c1fd888b68ffc2a9ba54fe4301118d66",
      "new_mode": 33188,
      "new_path": "hw/s390x/virtio-ccw.c"
    },
    {
      "type": "modify",
      "old_id": "23ba625eb6b4f21f445ba4b0181ca6321c82600f",
      "old_mode": 33188,
      "old_path": "hw/virtio/virtio-mmio.c",
      "new_id": "c2c6d854750c82013263c731aaff0d77db6e9a57",
      "new_mode": 33188,
      "new_path": "hw/virtio/virtio-mmio.c"
    },
    {
      "type": "modify",
      "old_id": "247325c1933ca5cd503a40b8652cb44ec0ac41f3",
      "old_mode": 33188,
      "old_path": "hw/virtio/virtio-pci.c",
      "new_id": "02fb84a8faa051c31329ba420acbe62f6bc9de8c",
      "new_mode": 33188,
      "new_path": "hw/virtio/virtio-pci.c"
    },
    {
      "type": "modify",
      "old_id": "98c4819fcc4770477ce9660553757f3eb09c91df",
      "old_mode": 33188,
      "old_path": "hw/virtio/virtio.c",
      "new_id": "272d93072122980ca6cb490423bdb8fe86d44686",
      "new_mode": 33188,
      "new_path": "hw/virtio/virtio.c"
    },
    {
      "type": "modify",
      "old_id": "f236e94ca6b13d9c759af64528c0ef5dd9506cde",
      "old_mode": 33188,
      "old_path": "include/hw/virtio/virtio.h",
      "new_id": "f6b38f7e9c3e1dce93fd6e56bc7d4ef9559f12da",
      "new_mode": 33188,
      "new_path": "include/hw/virtio/virtio.h"
    }
  ]
}