From fe812fd89636f30adf77147e168ec8240ae345c1 Mon Sep 17 00:00:00 2001 From: Dudu Lu Date: Mon, 13 Apr 2026 17:05:26 +0800 Subject: [PATCH] vhost/vringh: Fix IOTLB permission in putu16_iotlb() putu16_iotlb() performs a write operation (__put_user / WRITE_ONCE) but requests IOTLB translation with VHOST_MAP_RO (read-only permission). This means the IOTLB lookup succeeds only if the page has read permission, ignoring write permission entirely. A page mapped read-only in the IOTLB would incorrectly allow the write, while a page mapped write-only would incorrectly deny it. The neighbouring getu16_iotlb() correctly uses VHOST_MAP_RO for its read operation, and the copydesc write path (putdesc_iotlb) correctly uses VHOST_MAP_WO, confirming this is a copy-paste error. Fix by changing VHOST_MAP_RO to VHOST_MAP_WO to match the write semantics of putu16_iotlb(). Fixes: 0ea9ee430111 ("vhost/vringh: add IOTLB support") Signed-off-by: Dudu Lu Signed-off-by: Michael S. Tsirkin Message-ID: <20260413090526.80563-1-phx0fer@gmail.com> --- drivers/vhost/vringh.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c index 74836eb60c7a..51edd54f7107 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -1244,7 +1244,7 @@ static inline int putu16_iotlb(const struct vringh *vrh, /* Atomic write is needed for putu16 */ ret = iotlb_translate(vrh, (u64)(uintptr_t)p, sizeof(*p), - NULL, &ivec, VHOST_MAP_RO); + NULL, &ivec, VHOST_MAP_WO); if (ret < 0) return ret;