> From c165d81ad210155e0ac8eff7a571d9e525c00113 Mon Sep 17 00:00:00 2001 > From: Haoran Wang <[email protected]> > Date: Thu, 15 Oct 2026 16:59:32 +0800 > Subject: [PATCH] vringh: validate user address in the IOTLB use_va read helper > > getu16_iotlb() reads a 2-byte value from the address returned by > iotlb_translate() using __get_user(), which skips access_ok(). > iotlb_translate() only performs an IOTLB interval lookup and does not > validate the address as a user pointer. In the vhost-vdpa + vdpa_sim > use_va path, vdpa_sim's default passthrough IOTLB identity-maps the > whole address space and vdpasim_set_vq_address() stores the > controller-supplied vring address verbatim, so a controller with > CAP_NET_ADMIN can point the vring avail_user_addr at a kernel address. > On a vq kick the worker then dereferences that kernel address via > __get_user(), leaking 2 bytes of kernel memory per read; the value is > disclosed to dmesg by vringh_bad(). > > get_user() is access_ok() + __get_user(), use it instead so a kernel > address is rejected with -EFAULT rather than dereferenced. > > > Signed-off-by: Haoran Wang <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great! -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
