kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-26 19:14:18 +00:00
Code Issues Releases Packages Activity
linux/drivers/vhost
History
Dongli Zhang bd8c9404e4 vhost-scsi: protect vq->log_used with vq->mutex 
[ Upstream commit f591cf9fce ]

The vhost-scsi completion path may access vq->log_base when vq->log_used is
already set to false.

    vhost-thread                       QEMU-thread

vhost_scsi_complete_cmd_work()
-> vhost_add_used()
   -> vhost_add_used_n()
      if (unlikely(vq->log_used))
                                      QEMU disables vq->log_used
                                      via VHOST_SET_VRING_ADDR.
                                      mutex_lock(&vq->mutex);
                                      vq->log_used = false now!
                                      mutex_unlock(&vq->mutex);

				      QEMU gfree(vq->log_base)
        log_used()
        -> log_write(vq->log_base)

Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be
reclaimed via gfree(). As a result, this causes invalid memory writes to
QEMU userspace.

The control queue path has the same issue.

Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Message-Id: <20250403063028.16045-2-dongli.zhang@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-05-29 11:01:59 +02:00
..
iotlb.c vhost_iotlb: split out IOTLB initialization 2022-05-31 12:44:28 -04:00
Kconfig vhost_task: Allow vhost layer to use copy_process 2023-03-23 12:45:36 +01:00
Makefile vhost: introduce vDPA-based backend 2020-04-02 10:41:40 -04:00
net.c net: extend ubuf_info callback to ops structure 2024-04-22 16:21:35 -07:00
scsi.c vhost-scsi: protect vq->log_used with vq->mutex 2025-05-29 11:01:59 +02:00
test.c vhost-test: remove meaningless debug info 2023-02-20 19:26:58 -05:00
test.h tools/virtio: Add --reset 2020-06-22 12:34:21 -04:00
vdpa.c vhost_vdpa: assign irq bypass producer token correctly 2024-09-10 02:51:47 -04:00
vhost.c vhost: return task creation error instead of NULL 2025-03-22 12:54:21 -07:00
vhost.h vhost_task: Handle SIGKILL by flushing work and exiting 2024-05-22 08:31:15 -04:00
vringh.c vringh: add MODULE_DESCRIPTION() 2024-07-09 08:42:40 -04:00
vsock.c vsock/virtio: add SIOCOUTQ support for all virtio based transports 2024-08-02 09:20:28 +01:00