docs/devel/secure-coding-practices.rst

5 be aware of so that they can develop safe code and audit existing code
9 -----------------------
15 ---------------------------------
29 * Use-after-free and double-free
39 ----------------
62           unit = &mydev->unit[val];   <-- this input wasn't validated!
67 If ``val`` is not in range [0, 1] then an out-of-bounds memory access will take
68 place when ``unit`` is dereferenced.  The code must check that ``val`` is 0 or
72 --------------------------
74 moments.  Device emulation code must not assume that the guest follows the
79 A related issue is that device emulation code must be prepared for unexpected
81 well-behaved guest might wait for a completion interrupt before accessing
82 certain device registers.  Device emulation code must handle the case where the
88 ``qemu_log_mask(LOG_GUEST_ERROR, ...)``.  The ``-d guest_errors`` command-line
92 --------------
94 Live migration code must validate inputs when loading device state so an
100 -------------------------
101 Guests with multiple vCPUs may modify guest RAM while device emulation code is
102 running.  Device emulation code must copy in descriptors and other guest RAM
104 time-of-check-to-time-of-use (TOCTOU) race conditions that could cause QEMU to
105 crash when a vCPU thread modifies guest RAM while device emulation is
108 Use of null-co block drivers
109 ----------------------------
111 The ``null-co`` block driver is designed for performance: its read accesses are
113 research, it must be used with the ``read-zeroes=on`` option which fills read
115 (``read-zeroes=off``) will be discarded.