kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

block: fix status value size

Browse Source 
As per VirtIO spec 1.2 section 5.2.6, the `status` field is a byte, not
u32. cloud-hypervisor writes an `u32` to guest memory, which
accidentally zeros out the following 3 bytes, and may corrupt guest OS
internal state.

Signed-off-by: Changyuan Lyu <changyuanl@google.com>
This commit is contained in:
Changyuan Lyu
2024-07-12 22:54:12 -07:00
committed by Liu Wei
parent d89f1f4f21
commit bc6acb842f
3 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
block/src/lib.rs
View File

@@ -164,8 +164,8 @@ pub enum ExecuteError {
} }
impl ExecuteError { impl ExecuteError {
pub fn status(&self) -> u32 { pub fn status(&self) -> u8 {
match *self { let status = match *self {
ExecuteError::BadRequest(_) => VIRTIO_BLK_S_IOERR, ExecuteError::BadRequest(_) => VIRTIO_BLK_S_IOERR,
ExecuteError::Flush(_) => VIRTIO_BLK_S_IOERR, ExecuteError::Flush(_) => VIRTIO_BLK_S_IOERR,
ExecuteError::Read(_) => VIRTIO_BLK_S_IOERR, ExecuteError::Read(_) => VIRTIO_BLK_S_IOERR,
@@ -180,7 +180,8 @@ impl ExecuteError {
ExecuteError::AsyncWrite(_) => VIRTIO_BLK_S_IOERR, ExecuteError::AsyncWrite(_) => VIRTIO_BLK_S_IOERR,
ExecuteError::AsyncFlush(_) => VIRTIO_BLK_S_IOERR, ExecuteError::AsyncFlush(_) => VIRTIO_BLK_S_IOERR,
ExecuteError::TemporaryBufferAllocation(_) => VIRTIO_BLK_S_IOERR, ExecuteError::TemporaryBufferAllocation(_) => VIRTIO_BLK_S_IOERR,
} };
status as u8
} }
} }

2
vhost_user_block/src/lib.rs
View File

@@ -148,7 +148,7 @@ impl VhostUserBlkThread {
) { ) {
Ok(l) => { Ok(l) => {
len = l; len = l;
VIRTIO_BLK_S_OK VIRTIO_BLK_S_OK as u8
} }
Err(e) => { Err(e) => {
len = 1; len = 1;

4
virtio-devices/src/block.rs
View File

@@ -215,7 +215,7 @@ impl BlockEpollHandler {
} else { } else {
desc_chain desc_chain
.memory() .memory()
.write_obj(VIRTIO_BLK_S_OK, request.status_addr) .write_obj(VIRTIO_BLK_S_OK as u8, request.status_addr)
.map_err(Error::RequestStatus)?; .map_err(Error::RequestStatus)?;
// If no asynchronous operation has been submitted, we can // If no asynchronous operation has been submitted, we can
@@ -361,7 +361,7 @@ impl BlockEpollHandler {
.write_latency_avg .write_latency_avg
.store(write_avg, Ordering::Relaxed); .store(write_avg, Ordering::Relaxed);
(VIRTIO_BLK_S_OK, result as u32) (VIRTIO_BLK_S_OK as u8, result as u32)
} else { } else {
error!( error!(
"Request failed: {:x?} {:?}", "Request failed: {:x?} {:?}",