Re: [PATCH] vhost-vdpa: propagate set_map error to caller

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The patch introduces a critical DMA Use-After-Free (UAF) vulnerability by breaking the `v->in_batch` state machine.
--

--- Patch [1]: [PATCH] vhost-vdpa: propagate set_map error to caller ---
commit a21d695ba480576c165ed7bd7fa965169ba30248
Author: xiongweimin <xiongweimin@kylinos.cn>
vhost-vdpa: propagate set_map error to caller

This commit updates vhost_vdpa_process_iotlb_msg() to propagate the return
value of ops->set_map() during VHOST_IOTLB_BATCH_END operations. It modifies
the switch case to capture the error and break early.

> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index ac55275fa0d0a..908ca383b1522 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -1292,8 +1292,10 @@ static int vhost_vdpa_process_iotlb_msg(struct vhost_dev *dev, u32 asid,
>  		v->in_batch = true;
>  		break;
>  	case VHOST_IOTLB_BATCH_END:
> -		if (v->in_batch && ops->set_map)
> -			ops->set_map(vdpa, asid, iotlb);
> +		if (v->in_batch && ops->set_map) {
> +			r = ops->set_map(vdpa, asid, iotlb);
> +			break;
> +		}
>  		v->in_batch = false;
>  		break;

[Severity: Critical]
Does this early break bypass the reset of v->in_batch?

If VHOST_IOTLB_BATCH_END is processed and ops->set_map is present, the switch
statement exits before executing v->in_batch = false. This leaves v->in_batch
permanently set to true.

Later, if a VHOST_IOTLB_INVALIDATE message is processed, vhost_vdpa_unmap()
checks the batch status:

drivers/vhost/vdpa.c:vhost_vdpa_unmap() {
    ...
    if (ops->set_map) {
        if (!v->in_batch)
            ops->set_map(vdpa, asid, iotlb);
    }
    ...
}

Since v->in_batch is still true, ops->set_map() is skipped. The software
unpins and frees the host pages, but the hardware IOMMU mappings are never
removed. Could this regression allow the hardware device to DMA into reused
host memory after it is freed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716030242.124455-1-xiongwm2026@163.com?part=1