Dylan Reid 3bf94535d5 virtio-devices: block: reject duplicate in-flight head_index ...

A malicious or buggy guest can violate virtio by making the same
descriptor head available twice before the first chain has been placed
on the used ring. The submit path pushed both chains onto the
VecDeque-backed inflight_requests keyed by head_index, and on completion
find_inflight_request() returned the first linear match. That Request's
complete_async() freed its bounce buffer while the other chain's
io_uring op was still targeting it, producing a use-after-free the
kernel could then scribble into.

Signed-off-by: Dylan Reid <dgreid@fb.com>
(cherry picked from commit 544fa4aa76)

2026-05-14 14:47:42 -07:00

..

src

virtio-devices: block: reject duplicate in-flight head_index

2026-05-14 14:47:42 -07:00

build.rs

build: Add "fuzzing" as a valid cfg(..) attribute

2024-05-08 08:10:28 +00:00

Cargo.toml

misc: improve developer experience of cargo clippy

2025-11-17 16:59:49 +00:00