External/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2025-01-03 03:15:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio-devices: watchdog: Update process queue design

Browse Source 
Update the implementation of the process_queue() function to match all
other virtio devices implementations. This solves some issue related to
potential out-of-bound accesses to the former used_desc_heads list.

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
This commit is contained in:
Sebastien Boeuf 2022-09-16 10:26:12 +02:00 committed by Rob Bradford
parent a4f781e142
commit a5f655a032
1 changed files with 6 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
virtio-devices/src/watchdog.rs
View File

@ -18,7 +18,6 @@ use anyhow::anyhow;
use seccompiler::SeccompAction; use seccompiler::SeccompAction;
use std::fs::File; use std::fs::File;
use std::io::{self, Read}; use std::io::{self, Read};
use std::ops::Deref;
use std::os::unix::io::{AsRawFd, FromRawFd, RawFd}; use std::os::unix::io::{AsRawFd, FromRawFd, RawFd};
use std::result; use std::result;
use std::sync::atomic::AtomicBool; use std::sync::atomic::AtomicBool;
@ -75,8 +74,7 @@ impl WatchdogEpollHandler {
// descriptor. In response the device writes a 1 into the descriptor and returns it to the driver // descriptor. In response the device writes a 1 into the descriptor and returns it to the driver
fn process_queue(&mut self) -> result::Result<bool, Error> { fn process_queue(&mut self) -> result::Result<bool, Error> {
let queue = &mut self.queue; let queue = &mut self.queue;
let mut used_desc_heads = [(0, 0); QUEUE_SIZE as usize]; let mut used_descs = false;
let mut used_count = 0;
while let Some(mut desc_chain) = queue.pop_descriptor_chain(self.mem.memory()) { while let Some(mut desc_chain) = queue.pop_descriptor_chain(self.mem.memory()) {
let desc = desc_chain.next().ok_or(Error::DescriptorChainTooShort)?; let desc = desc_chain.next().ok_or(Error::DescriptorChainTooShort)?;
@ -96,17 +94,13 @@ impl WatchdogEpollHandler {
self.last_ping_time.lock().unwrap().replace(Instant::now()); self.last_ping_time.lock().unwrap().replace(Instant::now());
} }
used_desc_heads[used_count] = (desc_chain.head_index(), len); queue
used_count += 1; .add_used(desc_chain.memory(), desc_chain.head_index(), len)
.map_err(Error::QueueAddUsed)?;
used_descs = true;
} }
let mem = self.mem.memory(); Ok(used_descs)
for &(desc_index, len) in &used_desc_heads[..used_count] {
queue
.add_used(mem.deref(), desc_index, len)
.map_err(Error::QueueAddUsed)?;
}
Ok(used_count > 0)
} }
fn signal_used_queue(&self) -> result::Result<(), DeviceError> { fn signal_used_queue(&self) -> result::Result<(), DeviceError> {