kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/vhost
History
Dongli Zhang ca85c2d0db vhost-scsi: protect vq->log_used with vq->mutex 
[ Upstream commit f591cf9fce ]

The vhost-scsi completion path may access vq->log_base when vq->log_used is
already set to false.

    vhost-thread                       QEMU-thread

vhost_scsi_complete_cmd_work()
-> vhost_add_used()
   -> vhost_add_used_n()
      if (unlikely(vq->log_used))
                                      QEMU disables vq->log_used
                                      via VHOST_SET_VRING_ADDR.
                                      mutex_lock(&vq->mutex);
                                      vq->log_used = false now!
                                      mutex_unlock(&vq->mutex);

				      QEMU gfree(vq->log_base)
        log_used()
        -> log_write(vq->log_base)

Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be
reclaimed via gfree(). As a result, this causes invalid memory writes to
QEMU userspace.

The control queue path has the same issue.

Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Message-Id: <20250403063028.16045-2-dongli.zhang@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-06-04 14:41:53 +02:00
..
iotlb.c vhost_iotlb: split out IOTLB initialization 2022-05-31 12:44:28 -04:00
Kconfig vhost_task: Allow vhost layer to use copy_process 2023-03-23 12:45:36 +01:00
Makefile vhost: introduce vDPA-based backend 2020-04-02 10:41:40 -04:00
net.c vhost: convert poll work to be vq based 2023-07-03 12:15:13 -04:00
scsi.c vhost-scsi: protect vq->log_used with vq->mutex 2025-06-04 14:41:53 +02:00
test.c vhost-test: remove meaningless debug info 2023-02-20 19:26:58 -05:00
test.h tools/virtio: Add --reset 2020-06-22 12:34:21 -04:00
vdpa.c vhost_vdpa: assign irq bypass producer token correctly 2024-10-04 16:29:40 +02:00
vhost.c vhost_task: Handle SIGKILL by flushing work and exiting 2024-07-11 12:49:10 +02:00
vhost.h vhost_task: Handle SIGKILL by flushing work and exiting 2024-07-11 12:49:10 +02:00
vringh.c vringh: don't use vringh_kiov_advance() in vringh_iov_xfer() 2023-10-04 08:26:48 +01:00
vsock.c vhost/vsock: always initialize seqpacket_allow 2024-08-03 08:54:01 +02:00