Bo Chen 544fa4aa76 virtio-devices: block: reject duplicate in-flight head_index ...

A malicious or buggy guest can violate virtio by making the same
descriptor head available twice before the first chain has been placed
on the used ring. The submit path pushed both chains onto the
VecDeque-backed inflight_requests keyed by head_index, and on completion
find_inflight_request() returned the first linear match. That Request's
complete_async() freed its bounce buffer while the other chain's
io_uring op was still targeting it, producing a use-after-free the
kernel could then scribble into.

Signed-off-by: Dylan Reid <dgreid@fb.com>
Signed-off-by: Bo Chen <bchen@crusoe.ai>

2026-05-14 18:43:14 +00:00

..

src

virtio-devices: block: reject duplicate in-flight head_index

2026-05-14 18:43:14 +00:00

build.rs

build: Add "fuzzing" as a valid cfg(..) attribute

2024-05-08 08:10:28 +00:00

Cargo.toml

virtio-devices: Add set_notifier() method to VirtioInterrupt

2026-03-18 09:25:27 +00:00