fix(virtio-mmio): preserve cumulative status bits (CVE-2026-5747)

The previous match-based state machine validated which new bit was being
set against the current device_status, but then assigned
self.device_status = status using the raw guest-supplied value. A guest
could write FEATURES_OK alone instead of ACKNOWLEDGE | DRIVER |
FEATURES_OK, dropping previously-set bits and breaking the virtio state
machine invariants.

Replace the match with a VALID_TRANSITIONS table and an explicit
equality check. Anything not in the table (including bit-drop attacks
and skip-step writes) is rejected with a warning.

Manual port of upstream commit 4a52198 (PR firecracker-microvm#5818). The upstream
commit could not be cherry-picked cleanly because by v1.15.x the
mmio transport lives in a different file, the activate() signature
gained an interrupt argument, and the failure path uses
DEVICE_NEEDS_RESET / VirtioInterruptType, none of which exist in
v1.6.5. The control flow and the VALID_TRANSITIONS contents are
deliberately kept identical to upstream so future security audits
can compare line-for-line.

CVE: CVE-2026-5747

Author: libre-man

src/vmm/src/devices/virtio/mmio.rs

@@ -172,55 +172,58 @@ impl MmioTransport {
     #[allow(unused_assignments)]
     fn set_device_status(&mut self, status: u32) {
         use device_status::*;
-        // match changed bits
-        match !self.device_status & status {
-            ACKNOWLEDGE if self.device_status == INIT => {
-                self.device_status = status;
-            }
-            DRIVER if self.device_status == ACKNOWLEDGE => {
-                self.device_status = status;
+
+        const VALID_TRANSITIONS: &[(u32, u32)] = &[
+            (INIT, ACKNOWLEDGE),
+            (ACKNOWLEDGE, ACKNOWLEDGE | DRIVER),
+            (ACKNOWLEDGE | DRIVER, ACKNOWLEDGE | DRIVER | FEATURES_OK),
+            (
+                ACKNOWLEDGE | DRIVER | FEATURES_OK,
+                ACKNOWLEDGE | DRIVER | FEATURES_OK | DRIVER_OK,
+            ),
+        ];
+
+        if (status & FAILED) != 0 {
+            // TODO: notify backend driver to stop the device
+            self.device_status |= FAILED;
+        } else if status == INIT {
+            if self.locked_device().is_activated() {
+                let mut device_status = self.device_status;
+                let reset_result = self.locked_device().reset();
+                match reset_result {
+                    Some((_interrupt_evt, mut _queue_evts)) => {}
+                    None => {
+                        device_status |= FAILED;
+                    }
+                }
+                self.device_status = device_status;
             }
-            FEATURES_OK if self.device_status == (ACKNOWLEDGE | DRIVER) => {
-                self.device_status = status;
+
+            // If the backend device driver doesn't support reset,
+            // just leave the device marked as FAILED.
+            if self.device_status & FAILED == 0 {
+                self.reset();
             }
-            DRIVER_OK if self.device_status == (ACKNOWLEDGE | DRIVER | FEATURES_OK) => {
-                self.device_status = status;
+        } else if VALID_TRANSITIONS
+            .iter()
+            .any(|&(from, to)| self.device_status == from && status == to)
+        {
+            self.device_status = status;
+
+            // Activate the device when transitioning to DRIVER_OK.
+            if status == (ACKNOWLEDGE | DRIVER | FEATURES_OK | DRIVER_OK) {
                 let device_activated = self.locked_device().is_activated();
                 if !device_activated && self.are_queues_valid() {
                     self.locked_device()
                         .activate(self.mem.clone())
                         .expect("Failed to activate device");
                 }
             }
-            _ if (status & FAILED) != 0 => {
-                // TODO: notify backend driver to stop the device
-                self.device_status |= FAILED;
-            }
-            _ if status == 0 => {
-                if self.locked_device().is_activated() {
-                    let mut device_status = self.device_status;
-                    let reset_result = self.locked_device().reset();
-                    match reset_result {
-                        Some((_interrupt_evt, mut _queue_evts)) => {}
-                        None => {
-                            device_status |= FAILED;
-                        }
-                    }
-                    self.device_status = device_status;
-                }
-
-                // If the backend device driver doesn't support reset,
-                // just leave the device marked as FAILED.
-                if self.device_status & FAILED == 0 {
-                    self.reset();
-                }
-            }
-            _ => {
-                warn!(
-                    "invalid virtio driver status transition: 0x{:x} -> 0x{:x}",
-                    self.device_status, status
-                );
-            }
+        } else {
+            warn!(
+                "invalid virtio driver status transition: {:#x} -> {:#x}",
+                self.device_status, status
+            );
         }
     }
 }