diff options
author | Zach Reizner <zachr@google.com> | 2020-05-06 12:37:30 -0700 |
---|---|---|
committer | Commit Bot <commit-bot@chromium.org> | 2020-05-07 22:59:35 +0000 |
commit | a1c0e3c680c44ae4a949744b27f3cf0f7ea77939 (patch) | |
tree | 7300cd789e9ce31f75672d9ad03b006732ed4417 /devices/src/virtio/wl.rs | |
parent | a7237949da6d365957a04f99dc0b50c1ca1bed9b (diff) | |
download | crosvm-a1c0e3c680c44ae4a949744b27f3cf0f7ea77939.tar crosvm-a1c0e3c680c44ae4a949744b27f3cf0f7ea77939.tar.gz crosvm-a1c0e3c680c44ae4a949744b27f3cf0f7ea77939.tar.bz2 crosvm-a1c0e3c680c44ae4a949744b27f3cf0f7ea77939.tar.lz crosvm-a1c0e3c680c44ae4a949744b27f3cf0f7ea77939.tar.xz crosvm-a1c0e3c680c44ae4a949744b27f3cf0f7ea77939.tar.zst crosvm-a1c0e3c680c44ae4a949744b27f3cf0f7ea77939.zip |
remove instantes of using IntoRawFd in unsafe blocks
The trait IntoRawFd isn't marked unsafe, but its documentation says that an impl must return a uniquely owned RawFd. Some code blocks depended on that behavior to ensure safety with the unsafe File::from_raw_fd, but this leads to a soundness hole where a nominally safe impl of IntoRawFd can lead to unsafety in functions that had been left as safe. This change sidesteps the issue by not using IntoRawFd, and using only safe conversions instead. BUG=None TEST=cargo build --features='wl-dmabuf plugin' Change-Id: I9b357e5592be21189fb96e343823dd63000aac30 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2185580 Reviewed-by: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Zach Reizner <zachr@chromium.org> Auto-Submit: Zach Reizner <zachr@chromium.org>
Diffstat (limited to 'devices/src/virtio/wl.rs')
-rw-r--r-- | devices/src/virtio/wl.rs | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/devices/src/virtio/wl.rs b/devices/src/virtio/wl.rs index d59a801..8e94783 100644 --- a/devices/src/virtio/wl.rs +++ b/devices/src/virtio/wl.rs @@ -48,7 +48,7 @@ use std::thread; use std::time::Duration; #[cfg(feature = "wl-dmabuf")] -use libc::{dup, EBADF, EINVAL}; +use libc::{EBADF, EINVAL}; use data_model::VolatileMemoryError; use data_model::*; @@ -587,15 +587,13 @@ impl WlVfd { })?; match allocate_and_register_gpu_memory_response { VmMemoryResponse::AllocateAndRegisterGpuMemory { - fd, + fd: MaybeOwnedFd::Owned(file), pfn, slot, desc, } => { let mut vfd = WlVfd::default(); - // Duplicate FD for shared memory instance. - let raw_fd = unsafe { File::from_raw_fd(dup(fd.as_raw_fd())) }; - let vfd_shm = SharedMemory::from_raw_fd(raw_fd).map_err(WlError::NewAlloc)?; + let vfd_shm = SharedMemory::from_file(file).map_err(WlError::NewAlloc)?; vfd.guest_shared_memory = Some((vfd_shm.size(), vfd_shm.into())); vfd.slot = Some((slot, pfn, vm)); vfd.is_dmabuf = true; |