kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio-devices: mem: Return early in state_request for invalid ranges

Browse Source 
When is_valid_range() returns false, the handler still computed
offset = addr - config.addr which can underflow if addr is below the
region base, then queried the bitmap at a meaningless index. Return
(ERROR, 0) immediately so no arithmetic runs on invalid input.

Signed-off-by: Rob Bradford <rbradford@meta.com>
Assisted-by: Claude:claude-opus-4-6
This commit is contained in:
Rob Bradford
2026-05-06 14:17:22 +01:00
parent 97e16f249f
commit 1dd588fa6d
1 changed files with 4 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
virtio-devices/src/mem.rs
View File

@@ -601,11 +601,9 @@ impl MemEpollHandler {
let config = self.config.lock().unwrap();
let size: u64 = nb_blocks as u64 * config.block_size;
let resp_type = if config.is_valid_range(addr, size) {
VIRTIO_MEM_RESP_ACK
} else {
VIRTIO_MEM_RESP_ERROR
};
if !config.is_valid_range(addr, size) {
return (VIRTIO_MEM_RESP_ERROR, 0);
}
let offset = addr - config.addr;
let first_block_index = (offset / config.block_size) as usize;
@@ -627,7 +625,7 @@ impl MemEpollHandler {
VIRTIO_MEM_STATE_MIXED
};
(resp_type, resp_state)
(VIRTIO_MEM_RESP_ACK, resp_state)
}
fn signal(&self, int_type: VirtioInterruptType) -> result::Result<(), DeviceError> {