Re: [PATCH 1/2] vringh: bound top-level re-entry into indirect tables

[sashiko-bot@kernel.org]

> In __vringh_iov(), the F_INDIRECT branch descends into the indirect
> table and continues before the descriptor accounting runs. A top-level
> indirect descriptor is therefore never charged to count. If such a
> descriptor sets NEXT to point back at itself, returning from the
> indirect table resumes at the same top-level descriptor, which is again
> not counted, so the walk never makes forward progress.
> 
> Because count stays flat and indirect_count is reset to 0 on every
> return to the top-level table, neither bound in the loop check trips.
> A guest can spin the vringh worker at 100% CPU inside __vringh_iov(),
> an uninterruptible host DoS.
> 
> Move the descriptor accounting above the indirect switch so that a
> top-level indirect descriptor is charged one top-level traversal step
> before the walk descends into its table, bringing this re-entry under
> the existing vrh->vring.num bound. Each top-level descriptor is still
> charged at most one step and indirect_count still bounds a single
> table, so legitimate chains (including the multiple-indirect case in
> tools/virtio/vringh_test.c) stay within vring.num, while a cyclic
> indirect descriptor is now rejected with -ELOOP.
> 
> Fixes: dbd29e075228 ("vringh: Fix loop descriptors check in the indirect cases")
> Cc: Xie Yongji <xieyongji@bytedance.com>
> Cc: stable@vger.kernel.org
> Assisted-by: Hawkeye:GLM-5.3-flash
> Assisted-by: Qoder:Qwen3.8-Max
> Signed-off-by: Fang Xieyan <fangxy@xiaopeng.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260922122955.69433-1-fangxy@xiaopeng.com?part=1