-
Type:
Bug
-
Resolution: Fixed
-
Priority:
Major
-
Affects Version/s: virtio 0.9.X legacy
-
None
on many architectures, accesses larger than 32 bit can not be atomic.
Thus access to a device config field of >4 bytes is inherently racy
in case field can change.
For example, virtio-blk has
u64 capacity;
The following race can trigger:
driver reads low 32 bit
both low and high 32 bit change
driver reads high 32 bit
as a result, capacity observed is composed of
old low bits and new high bits which does not
make sense.
For legacy devices, spec allowed byte by byte access,
making the race even more common.