From 1dd588fa6d0b6a9add9135d189ba70f13ec86ec4 Mon Sep 17 00:00:00 2001 From: Rob Bradford Date: Wed, 6 May 2026 14:17:22 +0100 Subject: [PATCH] virtio-devices: mem: Return early in state_request for invalid ranges When is_valid_range() returns false, the handler still computed offset = addr - config.addr which can underflow if addr is below the region base, then queried the bitmap at a meaningless index. Return (ERROR, 0) immediately so no arithmetic runs on invalid input. Signed-off-by: Rob Bradford Assisted-by: Claude:claude-opus-4-6 --- virtio-devices/src/mem.rs | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/virtio-devices/src/mem.rs b/virtio-devices/src/mem.rs index 06ecb3b7e..fcb27b956 100644 --- a/virtio-devices/src/mem.rs +++ b/virtio-devices/src/mem.rs @@ -601,11 +601,9 @@ impl MemEpollHandler { let config = self.config.lock().unwrap(); let size: u64 = nb_blocks as u64 * config.block_size; - let resp_type = if config.is_valid_range(addr, size) { - VIRTIO_MEM_RESP_ACK - } else { - VIRTIO_MEM_RESP_ERROR - }; + if !config.is_valid_range(addr, size) { + return (VIRTIO_MEM_RESP_ERROR, 0); + } let offset = addr - config.addr; let first_block_index = (offset / config.block_size) as usize; @@ -627,7 +625,7 @@ impl MemEpollHandler { VIRTIO_MEM_STATE_MIXED }; - (resp_type, resp_state) + (VIRTIO_MEM_RESP_ACK, resp_state) } fn signal(&self, int_type: VirtioInterruptType) -> result::Result<(), DeviceError> {