kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

devices: fw_cfg: Correctly handle short and long reads

Browse Source 
Fill the target MMIO buffer with zeroes to handle reads with access
sizes larger than the data and also check that the read access length
does not exceed the size of the backing slice (previously it just
checked the access size vs length not taking the offset into account).

Assisted-by: Claude:Opus-4.8
Signed-off-by: Rob Bradford <rbradford@meta.com>
This commit is contained in:
Rob Bradford
2026-07-01 17:25:03 +01:00
parent 5f5de2ebca
commit c5104a9f17
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
devices/src/legacy/fw_cfg.rs
View File

@@ -722,16 +722,18 @@ impl FwCfg {
}
fn read_content(content: &FwCfgContent, offset: u32, data: &mut [u8], size: u32) -> Option<u8> {
// Zero fill rather than the usual 0xff fill for QEMU compatibility
data.fill(0);
let start = offset as usize;
let end = start + size as usize;
match content {
FwCfgContent::Bytes(b) => {
if b.len() >= size as usize {
if end <= b.len() {
data.copy_from_slice(&b[start..end]);
}
}
FwCfgContent::Slice(s) => {
if s.len() >= size as usize {
if end <= s.len() {
data.copy_from_slice(&s[start..end]);
}
}
@@ -740,7 +742,9 @@ impl FwCfg {
}
FwCfgContent::U32(n) => {
let bytes = n.to_le_bytes();
data.copy_from_slice(&bytes[start..end]);
if end <= bytes.len() {
data.copy_from_slice(&bytes[start..end]);
}
}
}
Some(size as u8)