On Thu, Oct 15, 2026 at 03:23:45PM +0800, Haoran Wang wrote: > I'd like to report an issue in drivers/vhost/vringh.c:1216 (function > getu16_iotlb), found via static analysis of Linux 7.0.11 and verified > against the 7.2.10 source tree. I have reproduced the leak on an > unmodified 7.2.10 kernel.
This should fix it I think? Can you confirm pls? Signed-off-by: Michael S. Tsirkin <[email protected]> --- drivers/vhost/vringh.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/vhost/vringh.c b/drivers/vhost/vringh.c index 9066f9f12ba1..4b097170bd36 100644 --- a/drivers/vhost/vringh.c +++ b/drivers/vhost/vringh.c @@ -1213,7 +1213,11 @@ static inline int getu16_iotlb(const struct vringh *vrh, return ret; if (vrh->use_va) { - ret = __get_user(tmp, (__virtio16 __user *)ivec.iov.iovec[0].iov_base); + __virtio16 __user *uaddr = ivec.iov.iovec[0].iov_base; + + if (!access_ok(uaddr, sizeof(*p))) + return -EFAULT; + ret = __get_user(tmp, uaddr); if (ret) return ret; } else { @@ -1251,7 +1255,11 @@ static inline int putu16_iotlb(const struct vringh *vrh, tmp = cpu_to_vringh16(vrh, val); if (vrh->use_va) { - ret = __put_user(tmp, (__virtio16 __user *)ivec.iov.iovec[0].iov_base); + __virtio16 __user *uaddr = ivec.iov.iovec[0].iov_base; + + if (!access_ok(uaddr, sizeof(*p))) + return -EFAULT; + ret = __put_user(tmp, uaddr); if (ret) return ret; } else {
