[i2c] Copy from correct result buffer

Copy the read data from the correct result buffer, otherwise
this results in incorrect data and/or memory overwrites in the
guest memory.

Signed-off-by: Vincent Whitchurch <vincent@whitchurch.se>
This commit is contained in:
Vincent Whitchurch 2021-10-16 11:01:46 +02:00 committed by Andreea Florescu
parent 6e585e9192
commit 27a19cfe67

View File

@ -184,7 +184,7 @@ impl<D: I2cDevice> VhostUserI2cBackend<D> {
}
};
for desc_chain in requests {
for (i, desc_chain) in requests.iter().enumerate() {
let descriptors: Vec<_> = desc_chain.clone().collect();
let desc_buf = descriptors[1];
let desc_in_hdr = descriptors[2];
@ -194,7 +194,7 @@ impl<D: I2cDevice> VhostUserI2cBackend<D> {
if desc_buf.is_write_only() {
desc_chain
.memory()
.write(&reqs.remove(0).buf, desc_buf.addr())
.write(&reqs[i].buf, desc_buf.addr())
.map_err(|_| Error::DescriptorWriteFailed)?;
}