Bytes: Fix read() and write()

read() and write() must not ignore the `count` parameter: The mappings
passed into the `try_access()` closure are only valid for up to `count`
bytes, not more.

(Note: We cannot really have a test case for this, as right now, memory
fragmentation will only happen exactly at memory region boundaries.  In
this case, `region.write()`/`region.read()` will only access the region
up until its end, even if the passed slice is longer, and so silently
ignore the length mismatch.  This change is necessary for when page
boundaries result in different mappings within a single region, i.e. the
region does not end at the fragmentation point, and calling
`region.write()`/`region.read()` would write/read across the boundary.
Because we don’t have IOMMU support yet, this can’t be tested.)

Signed-off-by: Hanna Czenczek <[email protected]>

Author: XanClic

CHANGELOG.md

@@ -34,6 +34,10 @@
   The `mmap(2)` syscall itself already validates that offset and length are valid, and trying to replicate this check
   in userspace ended up being imperfect.
 
+### Fixed
+
+- \[[#339](https://github.com/rust-vmm/vm-memory/pull/339)\] Fix `Bytes::read()` and `Bytes::write()` not to ignore `try_access()`'s `count` parameter
+
 ## \[v0.16.1\]
 
 ### Added

src/guest_memory.rs

@@ -558,8 +558,8 @@ impl<T: GuestMemory + ?Sized> Bytes<GuestAddress> for T {
         self.try_access(
             buf.len(),
             addr,
-            |offset, _count, caddr, region| -> Result<usize> {
-                region.write(&buf[offset..], caddr)
+            |offset, count, caddr, region| -> Result<usize> {
+                region.write(&buf[offset..(offset + count)], caddr)
             },
         )
     }
@@ -568,8 +568,8 @@ impl<T: GuestMemory + ?Sized> Bytes<GuestAddress> for T {
         self.try_access(
             buf.len(),
             addr,
-            |offset, _count, caddr, region| -> Result<usize> {
-                region.read(&mut buf[offset..], caddr)
+            |offset, count, caddr, region| -> Result<usize> {
+                region.read(&mut buf[offset..(offset + count)], caddr)
             },
         )
     }