Dylan Reid 376434a695 block: bounds-check the cumulative descriptor length ...

Request::execute and Request::execute_async checked each data descriptor
against `disk_nsectors` using the request's fixed start sector. With
sector = disk_nsectors-1 and N descriptors of 512 bytes each, every
descriptor passed (top = disk_nsectors) but the vectored I/O
collectively read/wrote N*512 bytes starting at the last sector — N-1
sectors past EOF.

For the io_uring/aio raw backends this lets the guest extend the host
disk image beyond its provisioned size, exhausting the host filesystem.
For fixed-VHD images (footer at end of file) the same chain overwrites
the footer with guest-controlled bytes, corrupting the disk image.

Replace the per-descriptor check with a chain-wide check_data_bounds().
Pre-validating the entire request before beginning the operation avoids
having to unroll a partial submit.

Signed-off-by: Dylan Reid <dgreid@fb.com>

2026-05-05 08:21:03 +00:00

..

src

block: bounds-check the cumulative descriptor length

2026-05-05 08:21:03 +00:00

Cargo.toml

build(deps): bump the non-rust-vmm group across 2 directories with 22 updates

2026-04-24 00:47:54 +00:00