github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

vhost: reject invalid IOTLB update permissions

Browse Source 
vhost_chr_write_iter() validates the type and size of an IOTLB update, but
does not validate its permission field. An invalid permission can therefore
reach perm_to_iommu_flags() and trigger its warning in vhost_vdpa_map().

Reject IOTLB UPDATE messages whose permission field is empty or contains
bits outside VHOST_ACCESS_RW before dispatching them to a backend.

Fixes: 4c8cf31885 ("vhost: introduce vDPA-based backend")
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260913-fix-vhost_chr_write_iter-v1-1-76bf1f436cfe@gmail.com>
This commit is contained in:
Linfeng Sun 2026-09-13 21:00:27 +08:00 committed by Michael S. Tsirkin
parent 1f8824fe7f
commit b179f21d2d
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/vhost/vhost.c
View File

@ -1766,7 +1766,8 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
goto done;
}
if (msg.type == VHOST_IOTLB_UPDATE && msg.size == 0) {
if (msg.type == VHOST_IOTLB_UPDATE &&
(!msg.size || !msg.perm || (msg.perm & ~VHOST_ACCESS_RW))) {
ret = -EINVAL;
goto done;
}