github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-11 20:13:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

vhost/vdpa: reject VRING_NUM larger than device max

Browse Source 
vhost_vring_set_num() accepts any non-zero power-of-two queue size that
fits in 16 bits. vhost-vdpa then passes that value to set_vq_num()
without comparing it with get_vq_num_max().

A process with access to /dev/vhost-vdpa-* can therefore configure a
queue larger than the device advertises. With vdpa_sim, the worker can
walk descriptors beyond the mapped descriptor ring. KASAN reports a
16-byte out-of-bounds read, corresponding to one vring_desc, in the
vringh IOTLB path:

  BUG: KASAN: out-of-bounds in _copy_from_iter
  Read of size 16
  copy_from_iotlb
  copydesc_iotlb
  vringh_getdesc_iotlb
  vdpasim_net_work

Cache get_vq_num_max() immediately after reset. Some backends derive
it from writable queue-size state, so querying it after SET_NUM may
return the current size instead of the device capability. Invalidate
the cached value before reset so a failed reset leaves SET_NUM
disabled.

For VHOST_SET_VRING_NUM, copy the complete vring state once and use
the same index and size for validation, vq->num, and set_vq_num().
This ensures that validation and use operate on the same copied values.

Fixes: 4c8cf31885 ("vhost: introduce vDPA-based backend")
Signed-off-by: Jia Jia <physicalmtea@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260810010300.132959-1-physicalmtea@gmail.com>
This commit is contained in:
Jia Jia 2026-08-10 09:03:00 +08:00 committed by Michael S. Tsirkin
parent 894f98e739
commit ccb1dc7c52
1 changed files with 37 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
drivers/vhost/vdpa.c
View File

@ -58,6 +58,7 @@ struct vhost_vdpa {
struct cdev cdev;
atomic_t opened;
u32 nvqs;
u16 vq_num_max;
int virtio_id;
int minor;
struct eventfd_ctx *config_ctx;
@ -236,7 +237,9 @@ static void vhost_vdpa_unsetup_vq_irq(struct vhost_vdpa *v, u16 qid)
static int _compat_vdpa_reset(struct vhost_vdpa *v)
{
struct vdpa_device *vdpa = v->vdpa;
const struct vdpa_config_ops *ops = vdpa->config;
u32 flags = 0;
int ret;
v->suspended = false;
@ -246,7 +249,14 @@ static int _compat_vdpa_reset(struct vhost_vdpa *v)
VDPA_RESET_F_CLEAN_MAP : 0;
}
return vdpa_reset(vdpa, flags);
v->vq_num_max = 0;
ret = vdpa_reset(vdpa, flags);
if (!ret) {
/* Some backends derive the max from mutable queue state. */
v->vq_num_max = ops->get_vq_num_max(vdpa);
}
return ret;
}
static int vhost_vdpa_reset(struct vhost_vdpa *v)
@ -648,9 +658,15 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
u32 idx;
long r;
r = get_user(idx, (u32 __user *)argp);
if (r < 0)
return r;
if (cmd == VHOST_SET_VRING_NUM) {
if (copy_from_user(&s, argp, sizeof(s)))
return -EFAULT;
idx = s.index;
} else {
r = get_user(idx, (u32 __user *)argp);
if (r < 0)
return r;
}
if (idx >= v->nvqs)
return -ENOBUFS;
@ -659,6 +675,23 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
vq = &v->vqs[idx];
switch (cmd) {
case VHOST_SET_VRING_NUM:
mutex_lock(&vq->mutex);
if (vq->private_data) {
r = -EBUSY;
} else if (!s.num || s.num > 0xffff ||
s.num > v->vq_num_max ||
(s.num & (s.num - 1))) {
r = -EINVAL;
} else {
vq->num = s.num;
r = 0;
}
mutex_unlock(&vq->mutex);
if (r)
return r;
ops->set_vq_num(vdpa, idx, s.num);
return 0;
case VHOST_VDPA_SET_VRING_ENABLE:
if (copy_from_user(&s, argp, sizeof(s)))
return -EFAULT;
@ -772,9 +805,6 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd,
ops->set_vq_cb(vdpa, idx, &cb);
break;
case VHOST_SET_VRING_NUM:
ops->set_vq_num(vdpa, idx, vq->num);
break;
}
return r;