From e244725e86be02cd85cb878b3ed8570eba2e4be1 Mon Sep 17 00:00:00 2001 From: Fang Xieyan Date: Wed, 21 Oct 2026 07:29:56 +0800 Subject: [PATCH] vhost: fix used ring index wrap in vhost_add_used_n_in_order MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit vhost_add_used_n_in_order() advances start by nheads[i] but wraps it with a single subtraction. If start + nheads[i] >= 2 * vq->num, start can remain outside the ring. With used-ring logging enabled, start > vq->num makes (vq->num - start) underflow. log_write() then sets bits beyond the dirty-log bitmap, potentially corrupting adjacent userspace memory. This is reachable on the vhost-net TX path with VIRTIO_F_IN_ORDER: done_idx can reach VHOST_NET_BATCH (64), triggering the issue with a 32-entry ring. Wrap start with a mask to keep it within the ring. VHOST_SET_VRING_NUM enforces a nonzero power-of-two ring size, allowing start to be wrapped using & (vq->num - 1). Fixes: 67a873df0c41 ("vhost: basic in order support") Cc: stable@vger.kernel.org Reviewed-by: Weibin Liu Signed-off-by: Fang Xieyan Acked-by: Eugenio Pérez Signed-off-by: Michael S. Tsirkin Message-ID: <20261020232956.99970-1-fangxy@xiaopeng.com> --- drivers/vhost/vhost.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c index 9ce46445a46b..ea127af58ada 100644 --- a/drivers/vhost/vhost.c +++ b/drivers/vhost/vhost.c @@ -3188,8 +3188,7 @@ static int vhost_add_used_n_in_order(struct vhost_virtqueue *vq, } start += nheads[i]; new += nheads[i]; - if (start >= vq->num) - start -= vq->num; + start &= vq->num - 1; } if (unlikely(vq->log_used)) {