On Sat, Aug 08, 2026 at 06:34:15PM +0800, Jia Jia wrote:
> vhost_vring_set_num() only requires a non-zero power-of-two that fits
> in 16 bits. vhost-vdpa then hands that value to the backend through
> set_vq_num() without comparing it to get_vq_num_max().
>
> A local process with access to /dev/vhost-vdpa-* can therefore set a
> queue size larger than the device advertises. On the vdpa_sim backend,
> the worker then walks descriptors beyond the mapped descriptor ring.
> KASAN reports a 16-byte out-of-bounds read, corresponding to one
> vring_desc, in the vringh IOTLB path:
>
> BUG: KASAN: out-of-bounds in _copy_from_iter
> Read of size 16
> copy_from_iotlb
> copydesc_iotlb
> vringh_getdesc_iotlb
> vdpasim_net_work
>
> Check the requested size against get_vq_num_max() in
> vhost_vdpa_vring_ioctl() before calling vhost_vring_ioctl(), and return
> -EINVAL when the request is too large.
>
> Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend")
sign off missing
> ---
> drivers/vhost/vdpa.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index ac55275fa0d0..b2083e1ef150 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -716,6 +716,13 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v,
> unsigned int cmd,
> vhost_vdpa_unsetup_vq_irq(v, idx);
> }
> break;
> + case VHOST_SET_VRING_NUM:
> + /* Reject sizes above the max reported by the device. */
> + if (copy_from_user(&s, argp, sizeof(s)))
> + return -EFAULT;
> + if (s.num > ops->get_vq_num_max(vdpa))
> + return -EINVAL;
> + break;
> }
>
> r = vhost_vring_ioctl(&v->vdev, cmd, argp);
> --
> 2.34.1
