Dylan Reid fbcf2fd6b0 virtio-devices: block: cap submit-loop iterations to virtqueue size ...

process_queue_submit's drain loop builds a fresh queue.iter() per
iteration, which re-reads the guest avail index on every call and has
no per-call cap (the per-iter gap check in virtio-queue only protects
against avail_idx jumping more than queue_size between two reads).
In theory, a malicous or buggy guest could keep adding descriptors and
cause this loop to overflow the iouring submit queue.

Cap a single drain at queue_size. A spec-compliant driver never
produces more than queue_size outstanding entries simultaneously, so
the cap is invisible to well-behaved guests.

Signed-off-by: Dylan Reid <dgreid@fb.com>

2026-05-04 09:08:43 +00:00

..

src

virtio-devices: block: cap submit-loop iterations to virtqueue size

2026-05-04 09:08:43 +00:00

build.rs

build: Add "fuzzing" as a valid cfg(..) attribute

2024-05-08 08:10:28 +00:00

Cargo.toml

virtio-devices: Add set_notifier() method to VirtioInterrupt

2026-03-18 09:25:27 +00:00