[UNIKRAFT PATCH] driver/virtio: fix virtqueue_vring allocation

[Hugo Lefeuvre <hugo.lefeuvre@xxxxxxxxx>]

virtqueue_create() allocates virtqueue_vring structures dynamically, but
the amount of memory requested to the memory allocator is incorrect:
sizeof(struct virtqueue) instead of sizeof(struct virtqueue_vring).

This bug is probably due to a simple oversight and has gone unnoticed
because of allocator-specific paddings.

This results in out-of-bounds write in virtqueue_buffer_enqueue.

Signed-off-by: Hugo Lefeuvre <hugo.lefeuvre@xxxxxxxxx>
---
 plat/drivers/virtio/virtio_ring.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plat/drivers/virtio/virtio_ring.c 
b/plat/drivers/virtio/virtio_ring.c
index ab9287a..0a5c3f3 100644
--- a/plat/drivers/virtio/virtio_ring.c
+++ b/plat/drivers/virtio/virtio_ring.c
@@ -366,7 +366,7 @@ struct virtqueue *virtqueue_create(__u16 queue_id, __u16 
nr_descs, __u16 align,
 
        UK_ASSERT(a);
 
-       vrq = uk_malloc(a, sizeof(struct virtqueue) +
+       vrq = uk_malloc(a, sizeof(*vrq) +
                        nr_descs * sizeof(struct virtqueue_desc_info));
        if (!vrq) {
                uk_pr_err("Allocation of virtqueue failed\n");
-- 
2.7.4