From b179f21d2d8a60ede29a00472bffdefb0284ef39 Mon Sep 17 00:00:00 2001 From: Linfeng Sun Date: Sun, 13 Sep 2026 21:00:27 +0800 Subject: [PATCH] vhost: reject invalid IOTLB update permissions vhost_chr_write_iter() validates the type and size of an IOTLB update, but does not validate its permission field. An invalid permission can therefore reach perm_to_iommu_flags() and trigger its warning in vhost_vdpa_map(). Reject IOTLB UPDATE messages whose permission field is empty or contains bits outside VHOST_ACCESS_RW before dispatching them to a backend. Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend") Signed-off-by: Linfeng Sun Signed-off-by: Michael S. Tsirkin Message-ID: <20260913-fix-vhost_chr_write_iter-v1-1-76bf1f436cfe@gmail.com> --- drivers/vhost/vhost.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index f2b9f4866628..9ce46445a46b 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -1766,7 +1766,8 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev, goto done; } - if (msg.type == VHOST_IOTLB_UPDATE && msg.size == 0) { + if (msg.type == VHOST_IOTLB_UPDATE && + (!msg.size || !msg.perm || (msg.perm & ~VHOST_ACCESS_RW))) { ret = -EINVAL; goto done; }