Repository navigation
Conversation
Coverage Report for CI Build 42962745661Coverage increased (+1.8%) to 45.634%Details
Uncovered Changes
Coverage Regressions2 previously-covered lines in 1 file lost coverage.
Coverage Stats
💛 - Coveralls |
Lencerf
force-pushed
the
fix/blk-critical
branch
2 times, most recently
from
November 11, 2026 04:49
819e9f5 to
1a38745
Compare
Block::handle_desc() previously required the 16-byte Request header to
occupy its own readable descriptor, the 1-byte status to occupy its own
writable descriptor, and IN/OUT payloads to consist of a single
descriptor. This rejected multi-segment scatter-gather block I/O as well
as split headers and coalesced header/data/status descriptors, violating
VirtIO 1.4 Sec 2.7.4 ("The device MUST NOT make assumptions about the
particular arrangement of descriptors").
Reshape DescChain in place by consuming the 16-byte Request header from
the front of readable and isolating the trailing 1-byte status slice in
writable, rejecting malformed buffer layouts with InvalidBuffer:
- Validate sector offsets with checked arithmetic and against the
capacity, completing out-of-range reads and writes with
Status::IOERR. A driver MUST NOT access beyond the capacity (Sec
5.2.6.1), and a write beyond it previously extended the disk image
file.
- Ignore any data in a FLUSH request, which a driver SHOULD NOT but may
include (Sec 5.2.6.1).
- In VirtioMio, transfer multi-segment IN/OUT payloads sequentially at
advancing file offsets, and propagate InvalidBuffer out of
handle_queue() so malformed descriptors fail the worker instead of
completing with len == 0 (which left a pre-zeroed status byte as
Status::OK).
- In VirtioIoUring, submit Readv and Writev against the reshaped
DescChain iovec slices, and complete requests from the reshaped chain
without re-reading the guest Request header (avoiding a guest TOCTOU
panic) while reporting short reads and writes as Status::IOERR.
- NUL-pad VIRTIO_BLK_T_GET_ID responses to VIRTIO_BLK_ID_SIZE (20 bytes)
per VirtIO 1.4 Sec 5.2.6.
Add unit tests covering scatter-gather I/O, split and coalesced framing,
FLUSH/GET_ID/RO/UNSUPP/capacity/overflow handling, malformed descriptor
propagation, and deferred completion.
Fixes: 01f5cac ("feat(block): impl raw file backed virtio-block dev")
Fixes: 213e216 ("refactor(blk): split descriptor handler to 2 parts")
Fixes: 342e016 ("feat(blk): io_uring based virtio-blk device")
Signed-off-by: Changyuan Lyu <changyuanl@google.com>
Lencerf
force-pushed
the
fix/blk-critical
branch
from
November 11, 2026 04:59
1a38745 to
5333463
Compare
Lencerf
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes descriptor framing and malformed-descriptor handling in
virtio-blk(alioth/src/virtio/dev/blk.rs), per VirtIO 1.4 Sec 2.7.4 and Sec 5.2.6.The
FLUSHdurability fix that was also in this PR is now in #545. Both PRs touch the same lines inVirtioMio::handle_queue(), so whichever merges second needs a rebase.DescChainin place by consuming the 16-byteRequestheader across arbitrary readable slice boundaries and isolating the trailing 1-bytestatusslice inwritable, rejecting malformed buffer layouts withInvalidBuffer.Status::IOERR. A driver MUST NOT access beyond the capacity (Sec 5.2.6.1), and a write beyond it previously extended the disk image file.FLUSHrequest, which a driver SHOULD NOT but may include (Sec 5.2.6.1).IN/OUTtransfers sequentially inVirtioMioand viaopcode::Readv/opcode::WritevinVirtioIoUring.io_uringrequests from the reshapedDescChainwithout re-parsing the guestRequestheader from RAM (eliminating a guest TOCTOUunreachable!()panic) and report short reads/writes asStatus::IOERR.InvalidBufferout ofVirtioMio::handle_queue()so malformed descriptor chains fail the worker (DEVICE_NEEDS_RESET) instead of completing withlen = 0and leaving a pre-zeroed gueststatusbyte asStatus::OK.VIRTIO_BLK_T_GET_IDresponses up toVIRTIO_BLK_ID_SIZE(20 bytes) and add unit tests inblk_test.rs.cargo +nightly fmt --check,cargo clippy --all-targets -D warningson x86_64-unknown-linux-gnu/musl, aarch64-unknown-linux-gnu and aarch64-apple-darwin, andcargo test --workspacepass locally.