vhost_chr_write_iter() validates the type and size of an IOTLB update, but
does not validate its permission field. An invalid permission can therefore
reach perm_to_iommu_flags() and trigger its warning in vhost_vdpa_map().
Reject IOTLB UPDATE messages whose permission field is empty or contains
bits outside VHOST_ACCESS_RW before dispatching them to a backend.
Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend")
Signed-off-by: Linfeng Sun <[email protected]>
---
The Poc sends a VHOST_IOTLB_UPDATE with perm=0:
[ 16.334240] ------------[ cut here ]------------
[ 16.334439] invalidate vhost IOTLB permission
[ 16.334700] WARNING: drivers/vhost/vdpa.c:1035 at
vhost_vdpa_map+0x232/0x240, CPU#1: poc/84
[ 16.336107] Modules linked in:
[ 16.336739] CPU: 1 UID: 0 PID: 84 Comm: poc Not tainted 7.3.0-rc2+ #3
PREEMPT(full)
[ 16.337376] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
1.16.3-debian-1.16.3-2 04/01/2014
[ 16.338035] RIP: 0010:vhost_vdpa_map+0x232/0x240
[ 16.338505] Code: c8 41 b9 c0 0c 40 00 4c 89 e6 48 8b b8 b8 00 00 00 e8 d2
22 88 ff 41 89 c7 e9 9c fe ff ff e8 25 85 90 fe 48 8d 3d 3e b2 f5 01 <67> 48 0f
b9 3a 41 bf 04 00 00 00 eb b6 90 90 90 90 90 90 90 90 90
[ 16.339394] RSP: 0018:ffffc90000e9bc00 EFLAGS: 00000246
[ 16.339796] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 16.340241] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff84d69230
[ 16.340631] RBP: ffffc90000e9bc58 R08: 0000000000000000 R09: 0000000000000000
[ 16.341073] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000100000
[ 16.341461] R13: ffff88800913cf70 R14: ffff8880090dd800 R15: 00000000ffffffff
[ 16.341906] FS: 000000002789c380(0000) GS:ffff8880f8536000(0000)
knlGS:0000000000000000
[ 16.342403] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 16.342731] CR2: 0000000000409f70 CR3: 0000000009079000 CR4: 00000000000006f0
[ 16.343374] Call Trace:
[ 16.344029] <TASK>
[ 16.344363] vhost_vdpa_process_iotlb_msg+0x896/0xdc0
[ 16.344912] ? __pfx_vhost_vdpa_process_iotlb_msg+0x10/0x10
[ 16.345399] vhost_chr_write_iter+0x168/0x7c0
[ 16.345739] ? apparmor_file_permission+0x29/0x40
[ 16.346159] vhost_vdpa_chr_write_iter+0x27/0x40
[ 16.346529] vfs_write+0x3e7/0x7c0
[ 16.346838] ? __pfx_vhost_vdpa_chr_write_iter+0x10/0x10
[ 16.347315] ksys_write+0xae/0x180
[ 16.347640] __x64_sys_write+0x22/0x40
[ 16.347964] x64_sys_call+0x1285/0x27e0
[ 16.348354] do_syscall_64+0xbf/0x550
[ 16.348674] ? do_syscall_64+0x31/0x550
[ 16.349067] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 16.349484] RIP: 0033:0x41bd24
[ 16.350187] Code: 89 02 48 c7 c0 ff ff ff ff eb bd 66 2e 0f 1f 84 00 00 00
00 00 90 f3 0f 1e fa 80 3d 3d 93 09 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00
f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89
[ 16.351030] RSP: 002b:00007fff105b3438 EFLAGS: 00000202 ORIG_RAX:
0000000000000001
[ 16.351506] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000041bd24
[ 16.351869] RDX: 0000000000000048 RSI: 00007fff105b3440 RDI: 0000000000000003
[ 16.352359] RBP: 00007fff105b3530 R08: 00000000004b4820 R09: 0000000000000000
[ 16.352733] R10: 0000000000000001 R11: 0000000000000202 R12: 00007fff105b35a8
[ 16.353167] R13: 00007fff105b35b8 R14: 00000000004af868 R15: 0000000000000001
[ 16.353626] </TASK>
---
drivers/vhost/vhost.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 44cac11b68d2..0adf0fea97b4 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1750,7 +1750,8 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
goto done;
}
- if (msg.type == VHOST_IOTLB_UPDATE && msg.size == 0) {
+ if (msg.type == VHOST_IOTLB_UPDATE &&
+ (!msg.size || !msg.perm || (msg.perm & ~VHOST_ACCESS_RW))) {
ret = -EINVAL;
goto done;
}
---
base-commit: ac7360d48607622cd3b1889e2d642a47e458d9e3
Best regards,
--
Linfeng Sun <[email protected]>
