Re: [PATCH] vringh: validate user address in the IOTLB use_va read helper

[sashiko-bot@kernel.org]

> From c165d81ad210155e0ac8eff7a571d9e525c00113 Mon Sep 17 00:00:00 2001
> From: Haoran Wang <haoranwangsec@gmail.com>
> Date: Thu, 15 Oct 2026 16:59:32 +0800
> Subject: [PATCH] vringh: validate user address in the IOTLB use_va read helper
> 
> getu16_iotlb() reads a 2-byte value from the address returned by
> iotlb_translate() using __get_user(), which skips access_ok().
> iotlb_translate() only performs an IOTLB interval lookup and does not
> validate the address as a user pointer.  In the vhost-vdpa + vdpa_sim
> use_va path, vdpa_sim's default passthrough IOTLB identity-maps the
> whole address space and vdpasim_set_vq_address() stores the
> controller-supplied vring address verbatim, so a controller with
> CAP_NET_ADMIN can point the vring avail_user_addr at a kernel address.
> On a vq kick the worker then dereferences that kernel address via
> __get_user(), leaking 2 bytes of kernel memory per read; the value is
> disclosed to dmesg by vringh_bad().
> 
> get_user() is access_ok() + __get_user(), use it instead so a kernel
> address is rejected with -EFAULT rather than dereferenced.
> 
> 
> Signed-off-by: Haoran Wang <haoranwangsec@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/6ad09d48.81b1ab59.3da7fb.9fc9@mx.google.com?part=1