From 355cbad09a7b1aaf27a016701a77bf34c67a85ce Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Sat, 7 Mar 2026 11:17:23 +0100 Subject: [PATCH] virtio-devices: iommu: Fix VirtioIommuConfig reserved field size Fix the _reserved field in VirtioIommuConfig from [u8; 7] to [u8; 3], correcting the struct size from 44 bytes to the spec-mandated 40 bytes. The virtio specification v1.2, Section 5.13.4 defines struct virtio_iommu_config as 40 bytes total. The kernel UAPI header linux/virtio_iommu.h matches this layout with __u8 reserved[3] since kernel 5.17. Prior to that, the struct was 36 bytes with no bypass field at all. The incorrect [u8; 7] made the packed struct 44 bytes. Since the struct is exposed to the guest, the guest saw a 44 byte device specific configuration region instead of 40 bytes. While well behaved guest drivers only access fields at known offsets and would not observe data corruption from the extra 4 zero bytes at the tail, the oversized config region is a spec violation. The write_config path is not affected because it validates the exact offset of the bypass field before allowing writes, and the bypass field sits at offset 36 regardless of the trailing reserved size. Signed-off-by: Anatol Belski --- virtio-devices/src/iommu.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/virtio-devices/src/iommu.rs b/virtio-devices/src/iommu.rs index f4812b04f..1097b6582 100644 --- a/virtio-devices/src/iommu.rs +++ b/virtio-devices/src/iommu.rs @@ -98,7 +98,7 @@ struct VirtioIommuConfig { domain_range: VirtioIommuRange32, probe_size: u32, bypass: u8, - _reserved: [u8; 7], + _reserved: [u8; 3], } /// Virtio IOMMU request type