From b731506c9fafac6bdbad86d38e5f006a4102f997 Mon Sep 17 00:00:00 2001 From: Hadi Orabi Date: Fri, 22 May 2026 12:18:00 -0700 Subject: [PATCH] ide: fix drive head toctou bug on enlightened path (#3535) The enlightened path in the IDE implementation is supposed to check whether the drive is busy, and bail out if so. We were checking if the drive is busy before switching the device head, meaning we could mistakenly go further down the enlightened path, even when the drive was busy. Fixed. --- vm/devices/storage/ide/src/lib.rs | 27 ++++++++++++++------------- 1 file changed, 14 insertions(+), 13 deletions(-) diff --git a/vm/devices/storage/ide/src/lib.rs b/vm/devices/storage/ide/src/lib.rs index 198b9c46b2..b8051dfb79 100644 --- a/vm/devices/storage/ide/src/lib.rs +++ b/vm/devices/storage/ide/src/lib.rs @@ -298,19 +298,6 @@ impl Channel { return IoResult::Err(IoError::InvalidAccessSize); } - if let Some(status) = self.current_drive_status() { - if status.err() { - tracelimit::warn_ratelimited!( - "drive is in error state, ignoring enlightened command", - ); - return IoResult::Ok; - } else if status.bsy() || status.drq() { - tracelimit::warn_ratelimited!( - "command is already pending on this drive, ignoring enlightened command" - ); - return IoResult::Ok; - } - } if self.enlightened_write.is_some() { tracelimit::error_ratelimited!("enlightened write while one is in progress, ignoring"); return IoResult::Ok; @@ -341,6 +328,20 @@ impl Channel { bus_master_state, ); + if let Some(status) = self.current_drive_status() { + if status.err() { + tracelimit::warn_ratelimited!( + "drive is in error state, ignoring enlightened command", + ); + return IoResult::Ok; + } else if status.bsy() || status.drq() { + tracelimit::warn_ratelimited!( + "command is already pending on this drive, ignoring enlightened command" + ); + return IoResult::Ok; + } + } + let result = if let Some(drive_type) = self.current_drive_type() { match drive_type { DriveType::Optical => {