mirror of
https://github.com/cloud-hypervisor/cloud-hypervisor.git
synced 2026-08-05 02:19:16 +00:00
355cbad09a
Fix the _reserved field in VirtioIommuConfig from [u8; 7] to [u8; 3], correcting the struct size from 44 bytes to the spec-mandated 40 bytes. The virtio specification v1.2, Section 5.13.4 defines struct virtio_iommu_config as 40 bytes total. The kernel UAPI header linux/virtio_iommu.h matches this layout with __u8 reserved[3] since kernel 5.17. Prior to that, the struct was 36 bytes with no bypass field at all. The incorrect [u8; 7] made the packed struct 44 bytes. Since the struct is exposed to the guest, the guest saw a 44 byte device specific configuration region instead of 40 bytes. While well behaved guest drivers only access fields at known offsets and would not observe data corruption from the extra 4 zero bytes at the tail, the oversized config region is a spec violation. The write_config path is not affected because it validates the exact offset of the bypass field before allowing writes, and the bypass field sits at offset 36 regardless of the trailing reserved size. Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>