From 1f0a78b766d2c86cd921607d03481f28bfc295dd Mon Sep 17 00:00:00 2001 From: Dylan Reid Date: Fri, 24 Apr 2026 17:13:31 -0700 Subject: [PATCH] vhost_user_block: set_config tolerates partial sub-range writes set_config() split the config slice at `offset` and copy_from_slice'd the entire suffix, which asserts src.len() == self.len(). This panics if the guest issues a write shorter than `config_len - offset`. Signed-off-by: Dylan Reid --- vhost_user_block/src/lib.rs | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/vhost_user_block/src/lib.rs b/vhost_user_block/src/lib.rs index 12b45f5ee..8d4109678 100644 --- a/vhost_user_block/src/lib.rs +++ b/vhost_user_block/src/lib.rs @@ -403,12 +403,14 @@ impl VhostUserBackendMut for VhostUserBlkBackend { let config_slice = self.config.as_mut_slice(); let data_len = data.len() as u32; let config_len = config_slice.len() as u32; - if offset + data_len > config_len { - error!("Failed to write config space"); + let end = offset + .checked_add(data_len) + .ok_or_else(|| io::Error::from_raw_os_error(libc::EINVAL))?; + if end > config_len { + error!("Failed to write config space: offset {offset} + len {data_len} > {config_len}"); return Err(io::Error::from_raw_os_error(libc::EINVAL)); } - let (_, right) = config_slice.split_at_mut(offset as usize); - right.copy_from_slice(data); + config_slice[offset as usize..end as usize].copy_from_slice(data); self.update_writeback(); Ok(()) }