kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/vhost
History
Qihang Tang 4bf5a51963 vhost/vdpa: validate virtqueue index in mmap and fault paths 
[ Upstream commit 929e4f0446 ]

vhost_vdpa_mmap() and vhost_vdpa_fault() use vma->vm_pgoff as a
virtqueue index for get_vq_notification(), but they do not validate
that the index is smaller than v->nvqs.

The ioctl path already performs both a bounds check and
array_index_nospec(), but the mmap/fault path only checks that the
index fits in u16. This allows an out-of-range queue index to reach
driver-specific get_vq_notification() callbacks.

Fix this by extracting a unified vhost_vdpa_get_vq_notification()
helper that validates the queue index against v->nvqs and applies
array_index_nospec() before calling the driver callback. Both the
mmap and fault paths use this helper, and the bounds checking is
consolidated into a single location.

From source inspection, the most defensible impact is out-of-bounds
access in the callback path, potentially leading to invalid PFN
remaps and crash/DoS.

Fixes: ddd89d0a05 ("vhost_vdpa: support doorbell mapping via mmap")
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Qihang Tang <q.h.hack.winter@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260508075821.92656-1-q.h.hack.winter@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-07-24 15:51:34 +02:00
..
iotlb.c vhost: handle error while adding split ranges to iotlb 2022-04-08 14:24:12 +02:00
Kconfig vhost_vdpa: implement IRQ offloading in vhost_vdpa 2020-08-05 11:08:42 -04:00
Makefile vhost: introduce vDPA-based backend 2020-04-02 10:41:40 -04:00
net.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
scsi.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
test.c tools/virtio: Add --reset 2020-06-22 12:34:21 -04:00
test.h tools/virtio: Add --reset 2020-06-22 12:34:21 -04:00
vdpa.c vhost/vdpa: validate virtqueue index in mmap and fault paths 2026-07-24 15:51:34 +02:00
vhost.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
vhost.h vhost: support PACKED when setting-getting vring_base 2023-06-14 11:13:09 +02:00
vringh.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00
vsock.c use less confusing names for iov_iter direction initializers 2026-06-19 13:33:46 +02:00