kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/drivers/vhost
History
Dongli Zhang 59614c5acf vhost-scsi: protect vq->log_used with vq->mutex 
commit f591cf9fce upstream.

The vhost-scsi completion path may access vq->log_base when vq->log_used is
already set to false.

    vhost-thread                       QEMU-thread

vhost_scsi_complete_cmd_work()
-> vhost_add_used()
   -> vhost_add_used_n()
      if (unlikely(vq->log_used))
                                      QEMU disables vq->log_used
                                      via VHOST_SET_VRING_ADDR.
                                      mutex_lock(&vq->mutex);
                                      vq->log_used = false now!
                                      mutex_unlock(&vq->mutex);

				      QEMU gfree(vq->log_base)
        log_used()
        -> log_write(vq->log_base)

Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be
reclaimed via gfree(). As a result, this causes invalid memory writes to
QEMU userspace.

The control queue path has the same issue.

Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Message-Id: <20250403063028.16045-2-dongli.zhang@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
[ resoloved conflicts in drivers/vhost/scsi.c
  bacause vhost_scsi_complete_cmd_work() has been refactored. ]
Signed-off-by: Xinyu Zheng <zhengxinyu6@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2025-07-17 18:32:15 +02:00
..
iotlb.c vhost_iotlb: split out IOTLB initialization 2022-05-31 12:44:28 -04:00
Kconfig vhost_vdpa: implement IRQ offloading in vhost_vdpa 2020-08-05 11:08:42 -04:00
Makefile vhost: introduce vDPA-based backend 2020-04-02 10:41:40 -04:00
net.c vhost_net: revert upend_idx only on retriable error 2023-06-28 11:12:40 +02:00
scsi.c vhost-scsi: protect vq->log_used with vq->mutex 2025-07-17 18:32:15 +02:00
test.c vhost: rename vhost_work_dev_flush 2022-05-31 12:45:10 -04:00
test.h tools/virtio: Add --reset 2020-06-22 12:34:21 -04:00
vdpa.c vhost_vdpa: assign irq bypass producer token correctly 2024-10-17 15:21:12 +02:00
vhost.c vhost: Add smp_rmb() in vhost_enable_notify() 2024-04-17 11:18:27 +02:00
vhost.h vhost: support PACKED when setting-getting vring_base 2023-06-14 11:15:33 +02:00
vringh.c vringh: don't use vringh_kiov_advance() in vringh_iov_xfer() 2023-10-10 22:00:38 +02:00
vsock.c vhost/vsock: always initialize seqpacket_allow 2024-08-03 08:49:21 +02:00