kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vhost_user_block: set_config tolerates partial sub-range writes

Browse Source 
set_config() split the config slice at `offset` and copy_from_slice'd
the entire suffix, which asserts src.len() == self.len(). This panics if
the guest issues a write shorter than `config_len - offset`.

Signed-off-by: Dylan Reid <dgreid@fb.com>
This commit is contained in:
Dylan Reid
2026-04-24 17:13:31 -07:00
committed by Rob Bradford
parent 5ca693495a
commit 1f0a78b766
1 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
vhost_user_block/src/lib.rs
View File

@@ -403,12 +403,14 @@ impl VhostUserBackendMut for VhostUserBlkBackend {
let config_slice = self.config.as_mut_slice(); let config_slice = self.config.as_mut_slice();
let data_len = data.len() as u32; let data_len = data.len() as u32;
let config_len = config_slice.len() as u32; let config_len = config_slice.len() as u32;
if offset + data_len > config_len { let end = offset
error!("Failed to write config space"); .checked_add(data_len)
.ok_or_else(|| io::Error::from_raw_os_error(libc::EINVAL))?;
if end > config_len {
error!("Failed to write config space: offset {offset} + len {data_len} > {config_len}");
return Err(io::Error::from_raw_os_error(libc::EINVAL)); return Err(io::Error::from_raw_os_error(libc::EINVAL));
} }
let (_, right) = config_slice.split_at_mut(offset as usize); config_slice[offset as usize..end as usize].copy_from_slice(data);
right.copy_from_slice(data);
self.update_writeback(); self.update_writeback();
Ok(()) Ok(())
} }