google / alioth / 42943648522

44%

Build Type

push

github

Committed by Lencerf

Commit Message

fix(virtio): set WRITE flag on packed used descriptors from len

PackedQueue::set_used() previously loaded the overwritten available
descriptor's flags and only toggled AVAIL and USED, preserving stale
WRITE, NEXT, and INDIRECT bits in the used descriptor.

Per VirtIO 1.4 Sec 2.8.3 and 2.8.4, VIRTQ_DESC_F_WRITE in a used
descriptor specifies whether the device wrote any data into any part
of the buffer, and Element Length is reserved and ignored by drivers
when VIRTQ_DESC_F_WRITE is clear. Consequently, any request starting
with a readable header or an indirect descriptor (or completed out of
order into a readable slot) produced a used descriptor with WRITE
clear even when len > 0, so a driver that ignores Element Length as
the spec allows would treat the written length as 0. Conversely,
completing a writable slot with len == 0 left WRITE set, and NEXT,
which is reserved in used descriptors (Sec 2.8.6), or INDIRECT leaked
into used flags.

Linux is not affected, since it reads the length of a used descriptor
regardless of VIRTQ_DESC_F_WRITE.

Construct the used descriptor flags from scratch instead, setting
USED | AVAIL from the ring wrap counter and WRITE iff len > 0.

Fixes: f97eb722e6fa ("feat(virtio): support packed queue")
Signed-off-by: Changyuan Lyu <changyuanl@google.com>

Coverage Stats

976 of 1750 branches covered (55.77%)

Branch coverage included in aggregate %.

8 of 8 new or added lines in 1 file covered. (100.0%)

2 existing lines in 1 file now uncovered.

6966 of 16444 relevant lines covered (42.36%)

905.78 hits per line