Skip to content

ide: fix drive head toctou bug on enlightened path#3535

Open
babayet2 wants to merge 2 commits into
microsoft:mainfrom
babayet2:enlightened_cd_fuzzer_fix
Open

ide: fix drive head toctou bug on enlightened path#3535
babayet2 wants to merge 2 commits into
microsoft:mainfrom
babayet2:enlightened_cd_fuzzer_fix

Conversation

@babayet2
Copy link
Copy Markdown
Collaborator

The enlightened path in the IDE implementation is supposed to check whether the drive is busy, and bail out if so.

We are currently checking if the drive is busy before switching the device head, meaning we can mistakenly go further down the enlightened path, even when the drive is busy.

@babayet2 babayet2 requested a review from a team as a code owner May 20, 2026 19:02
Copilot AI review requested due to automatic review settings May 20, 2026 19:02
@babayet2 babayet2 requested a review from a team as a code owner May 20, 2026 19:02
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Fixes a TOCTOU-style correctness issue in the IDE “enlightened INT13” fast path by ensuring the busy/error gating check is performed against the drive selected by the packet’s device_head value, rather than the previously-selected drive.

Changes:

  • Move the drive busy/error gating logic to occur after writing DeviceHead, so status is checked for the intended drive.
  • Keep the enlightened-path early-bail behavior for busy/DRQ/error states (now applied to the correct drive).

Comment on lines 349 to 353
self.write_drive_register(
DriveRegister::DeviceHead,
eint13_cmd.device_head.into(),
bus_master_state,
);
Comment on lines +355 to +359
if let Some(status) = self.current_drive_status() {
if status.err() {
tracelimit::warn_ratelimited!(
"drive is in error state, ignoring enlightened command",
);
@babayet2 babayet2 enabled auto-merge (squash) May 20, 2026 19:08
@babayet2 babayet2 disabled auto-merge May 20, 2026 19:09
@github-actions
Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants