On Mon, Aug 03, 2026 at 09:45:14AM +0800, Jun Yang wrote: > From: Jun Yang <[email protected]> > > vq->meta_iotlb[] caches the vhost_iotlb_map that backs each vring > metadata region, and iotlb_access_ok() returns early on a cache hit, > taking the hit as proof that the region has already been validated: > > if (vhost_vq_meta_fetch(vq, addr, len, type)) > return true; > > The cache is reset on VHOST_IOTLB_UPDATE and VHOST_IOTLB_INVALIDATE, on > device IOTLB (re)initialisation and on vq reset, but not when > VHOST_SET_VRING_ADDR replaces vq->desc, vq->avail and vq->used, nor when > VHOST_SET_VRING_NUM changes the region sizes. > > With a device IOTLB attached both ioctls are accepted while the vq is > live, and neither validates the addresses at ioctl time: vq_access_ok() > and vq_log_used_access_ok() return true early because the addresses are > GIOVAs, deferring validation to prefetch time. Once the cache has been > populated that deferred validation no longer runs -- vq_meta_prefetch() > hits the stale entry and returns true -- and vhost_vq_meta_fetch() keeps > translating through the old mapping as > > map->addr + addr - map->start > > for an address the mapping no longer covers. vhost_copy_to_user() and > vhost_copy_from_user() consume the result with __copy_to_user() and > __copy_from_user(), which do not check it either, so a subsequent used > ring update or descriptor fetch accesses memory outside the region the > IOTLB actually maps. > > Reset the metadata cache whenever the vring is reconfigured, so the new > addresses are pushed back through iotlb_access_ok()'s slow path. > > Fixes: f88949138058 ("vhost: introduce O(1) vq metadata cache") > Cc: [email protected] > Reported-by: TencentOS Corvus AI <[email protected]> > Signed-off-by: Jun Yang <[email protected]>
patch itself ok: Acked-by: Michael S. Tsirkin <[email protected]> > --- > drivers/vhost/vhost.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c > index 4c525b3e16ea..77c96993100b 100644 > --- a/drivers/vhost/vhost.c > +++ b/drivers/vhost/vhost.c > @@ -2126,6 +2126,14 @@ static long vhost_vring_set_num_addr(struct vhost_dev > *d, > BUG(); > } > > + /* > + * The metadata cache holds the IOTLB mapping that backed the previous > + * desc/avail/used addresses and vring size, both of which are being > + * replaced here. iotlb_access_ok() takes a cache hit as proof that the > + * region was validated, so the stale entries have to go. > + */ > + __vhost_vq_meta_reset(vq); > + > mutex_unlock(&vq->mutex); > > return r; > -- > 2.55.0
