github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

vhost/vringh: Fix IOTLB permission in putu16_iotlb()

Browse Source 
putu16_iotlb() performs a write operation (__put_user / WRITE_ONCE)
but requests IOTLB translation with VHOST_MAP_RO (read-only
permission).  This means the IOTLB lookup succeeds only if the page
has read permission, ignoring write permission entirely.  A page
mapped read-only in the IOTLB would incorrectly allow the write,
while a page mapped write-only would incorrectly deny it.

The neighbouring getu16_iotlb() correctly uses VHOST_MAP_RO for its
read operation, and the copydesc write path (putdesc_iotlb) correctly
uses VHOST_MAP_WO, confirming this is a copy-paste error.

Fix by changing VHOST_MAP_RO to VHOST_MAP_WO to match the write
semantics of putu16_iotlb().

Fixes: 0ea9ee430111 ("vhost/vringh: add IOTLB support")
Signed-off-by: Dudu Lu <phx0fer@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260413090526.80563-1-phx0fer@gmail.com>
This commit is contained in:
Dudu Lu 2026-04-13 17:05:26 +08:00 committed by Michael S. Tsirkin
parent a016d03a9c
commit fe812fd896
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/vhost/vringh.c
View File

@ -1244,7 +1244,7 @@ static inline int putu16_iotlb(const struct vringh *vrh,
/* Atomic write is needed for putu16 */
ret = iotlb_translate(vrh, (u64)(uintptr_t)p, sizeof(*p),
NULL, &ivec, VHOST_MAP_RO);
NULL, &ivec, VHOST_MAP_WO);
if (ret < 0)
return ret;