[PATCH] vhost-vdpa: propagate set_map error to caller

[PATCH] vhost-vdpa: propagate set_map error to caller

[Weimin Xiong]

From: xiongweimin <xiongweimin@kylinos.cn>

The return value of ops->set_map() is currently ignored when handling
VHOST_IOTLB_BATCH_END. If the backend fails to program the IOTLB,
the VMM incorrectly believes the operation succeeded and may continue
with stale or incorrect mappings.

Save and propagate the error from ops->set_map() in BATCH_END.

Signed-off-by: xiongweimin <xiongweimin@kylinos.cn>
---
 drivers/vhost/vdpa.c | 6 +++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index bb96b1aa5..ffbb10a92 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -1297,8 +1297,10 @@ static int vhost_vdpa_process_iotlb_msg(struct vhost_dev *dev, u32 asid,
 		v->in_batch = true;
 		break;
 	case VHOST_IOTLB_BATCH_END:
-		if (v->in_batch && ops->set_map)
-			ops->set_map(vdpa, asid, iotlb);
+		if (v->in_batch && ops->set_map) {
+			r = ops->set_map(vdpa, asid, iotlb);
+			break;
+		}
 		v->in_batch = false;
 		break;
 	default:
--
2.39.3

Re: [PATCH] vhost-vdpa: propagate set_map error to caller

[Eugenio Perez Martin]

On Thu, Jul 16, 2026 at 5:02 AM Weimin Xiong <xiongwm2026@163.com> wrote:
>
> From: xiongweimin <xiongweimin@kylinos.cn>
>
> The return value of ops->set_map() is currently ignored when handling
> VHOST_IOTLB_BATCH_END. If the backend fails to program the IOTLB,
> the VMM incorrectly believes the operation succeeded and may continue
> with stale or incorrect mappings.
>
> Save and propagate the error from ops->set_map() in BATCH_END.
>
> Signed-off-by: xiongweimin <xiongweimin@kylinos.cn>
> ---
>  drivers/vhost/vdpa.c | 6 +++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index bb96b1aa5..ffbb10a92 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -1297,8 +1297,10 @@ static int vhost_vdpa_process_iotlb_msg(struct vhost_dev *dev, u32 asid,
>                 v->in_batch = true;
>                 break;
>         case VHOST_IOTLB_BATCH_END:
> -               if (v->in_batch && ops->set_map)
> -                       ops->set_map(vdpa, asid, iotlb);
> +               if (v->in_batch && ops->set_map) {
> +                       r = ops->set_map(vdpa, asid, iotlb);
> +                       break;
> +               }
>                 v->in_batch = false;

Maybe this needs to be discussed, but v->in_batch should be set to
false even in failure case.

>                 break;
>         default:
> --
> 2.39.3
>

(no subject)

[Weimin Xiong]

From: xiongweimin <xiongweimin@kylinos.cn>

Hi Eugenio,

Thanks for your review!

You are right. My original patch has an issue with the `break` statement,
which skips the `v->in_batch = false` assignment when `set_map` fails.
The correct approach is to simply capture the return value without
breaking:

```c
case VHOST_IOTLB_BATCH_END:
    if (v->in_batch && ops->set_map)
        r = ops->set_map(vdpa, asid, iotlb);
    v->in_batch = false;
    break;
```

This way:
1. The return value of `set_map` is propagated to the caller
2. `v->in_batch` is always reset, regardless of success or failure

Updated patch attached below.

---

Subject: [PATCH] vhost-vdpa: propagate set_map error to caller

The return value of ops->set_map() is currently ignored when handling
VHOST_IOTLB_BATCH_END. If the backend fails to program the IOTLB,
the VMM incorrectly believes the operation succeeded and may continue
with stale or incorrect mappings.

Propagate the error from ops->set_map() to the caller.

Signed-off-by: xiongweimin <xiongweimin@kylinos.cn>
---
 drivers/vhost/vdpa.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index bb96b1aa5..b52d8d94e 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -1298,7 +1298,7 @@ static int vhost_vdpa_process_iotlb_msg(struct vhost_dev *dev, u32 asid,
 		break;
 	case VHOST_IOTLB_BATCH_END:
 		if (v->in_batch && ops->set_map)
-			ops->set_map(vdpa, asid, iotlb);
+			r = ops->set_map(vdpa, asid, iotlb);
 		v->in_batch = false;
 		break;
 	default:
--
2.39.3

Re: Re: [PATCH] vhost-vdpa: propagate set_map error to caller

[Weimin Xiong]

From: xiongweimin <xiongweimin@kylinos.cn>

Hi Eugenio,

Thanks for your review!

You are right. My original patch has an issue with the `break` statement,
which skips the `v->in_batch = false` assignment when `set_map` fails.
The correct approach is to simply capture the return value without
breaking:

```c
case VHOST_IOTLB_BATCH_END:
    if (v->in_batch && ops->set_map)
        r = ops->set_map(vdpa, asid, iotlb);
    v->in_batch = false;
    break;
```

This way:
1. The return value of `set_map` is propagated to the caller
2. `v->in_batch` is always reset, regardless of success or failure

Updated patch attached below.

---

Subject: [PATCH] vhost-vdpa: propagate set_map error to caller

The return value of ops->set_map() is currently ignored when handling
VHOST_IOTLB_BATCH_END. If the backend fails to program the IOTLB,
the VMM incorrectly believes the operation succeeded and may continue
with stale or incorrect mappings.

Propagate the error from ops->set_map() to the caller.

Signed-off-by: xiongweimin <xiongweimin@kylinos.cn>
---
 drivers/vhost/vdpa.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
index bb96b1aa5..b52d8d94e 100644
--- a/drivers/vhost/vdpa.c
+++ b/drivers/vhost/vdpa.c
@@ -1298,7 +1298,7 @@ static int vhost_vdpa_process_iotlb_msg(struct vhost_dev *dev, u32 asid,
 		break;
 	case VHOST_IOTLB_BATCH_END:
 		if (v->in_batch && ops->set_map)
-			ops->set_map(vdpa, asid, iotlb);
+			r = ops->set_map(vdpa, asid, iotlb);
 		v->in_batch = false;
 		break;
 	default:
--
2.39.3

Re: [PATCH] vhost-vdpa: propagate set_map error to caller

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The patch introduces a critical DMA Use-After-Free (UAF) vulnerability by breaking the `v->in_batch` state machine.
--

--- Patch [1]: [PATCH] vhost-vdpa: propagate set_map error to caller ---
commit a21d695ba480576c165ed7bd7fa965169ba30248
Author: xiongweimin <xiongweimin@kylinos.cn>
vhost-vdpa: propagate set_map error to caller

This commit updates vhost_vdpa_process_iotlb_msg() to propagate the return
value of ops->set_map() during VHOST_IOTLB_BATCH_END operations. It modifies
the switch case to capture the error and break early.

> diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c
> index ac55275fa0d0a..908ca383b1522 100644
> --- a/drivers/vhost/vdpa.c
> +++ b/drivers/vhost/vdpa.c
> @@ -1292,8 +1292,10 @@ static int vhost_vdpa_process_iotlb_msg(struct vhost_dev *dev, u32 asid,
>  		v->in_batch = true;
>  		break;
>  	case VHOST_IOTLB_BATCH_END:
> -		if (v->in_batch && ops->set_map)
> -			ops->set_map(vdpa, asid, iotlb);
> +		if (v->in_batch && ops->set_map) {
> +			r = ops->set_map(vdpa, asid, iotlb);
> +			break;
> +		}
>  		v->in_batch = false;
>  		break;

[Severity: Critical]
Does this early break bypass the reset of v->in_batch?

If VHOST_IOTLB_BATCH_END is processed and ops->set_map is present, the switch
statement exits before executing v->in_batch = false. This leaves v->in_batch
permanently set to true.

Later, if a VHOST_IOTLB_INVALIDATE message is processed, vhost_vdpa_unmap()
checks the batch status:

drivers/vhost/vdpa.c:vhost_vdpa_unmap() {
    ...
    if (ops->set_map) {
        if (!v->in_batch)
            ops->set_map(vdpa, asid, iotlb);
    }
    ...
}

Since v->in_batch is still true, ops->set_map() is skipped. The software
unpins and frees the host pages, but the hardware IOMMU mappings are never
removed. Could this regression allow the hardware device to DMA into reused
host memory after it is freed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716030242.124455-1-xiongwm2026@163.com?part=1