* [PATCH] vhost: reject zero-size IOTLB INVALIDATE
@ 2026-07-16 3:00 Weimin Xiong
0 siblings, 0 replies; 4+ messages in thread
From: Weimin Xiong @ 2026-07-16 3:00 UTC (permalink / raw)
To: virtualization; +Cc: mst, jasowangio, eperezma, netdev, xiongweimin
From: xiongweimin <xiongweimin@kylinos.cn>
Reject VHOST_IOTLB_INVALIDATE messages with size == 0 to prevent
iova + size - 1 from underflowing to U64_MAX, which would
incorrectly delete the entire IOTLB.
Signed-off-by: xiongweimin <xiongweimin@kylinos.cn>
---
drivers/vhost/vhost.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 3c080c454e374cabd7321416ed92c5f7d3135254..xxxxxxxxxx 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1656,6 +1656,10 @@ static int vhost_process_iotlb_msg(struct vhost_dev *dev, u32 asid,
if (!dev->iotlb) {
ret = -EFAULT;
break;
+ }
+ if (!msg->size) {
+ ret = -EINVAL;
+ break;
}
vhost_vq_meta_reset(dev);
vhost_iotlb_del_range(dev->iotlb, msg->iova,
--
2.39.3
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH] vhost: reject zero-size IOTLB INVALIDATE
@ 2026-07-16 3:02 Weimin Xiong
2026-07-16 9:41 ` Eugenio Perez Martin
0 siblings, 1 reply; 4+ messages in thread
From: Weimin Xiong @ 2026-07-16 3:02 UTC (permalink / raw)
To: virtualization; +Cc: mst, jasowangio, eperezma, netdev, kvm, xiongweimin
From: xiongweimin <xiongweimin@kylinos.cn>
Reject VHOST_IOTLB_INVALIDATE messages with size == 0 to prevent
iova + size - 1 from underflowing to U64_MAX, which would
incorrectly delete the entire IOTLB.
Signed-off-by: xiongweimin <xiongweimin@kylinos.cn>
---
drivers/vhost/vhost.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 3c080c454e374cabd7321416ed92c5f7d3135254..xxxxxxxxxx 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1656,6 +1656,10 @@ static int vhost_process_iotlb_msg(struct vhost_dev *dev, u32 asid,
if (!dev->iotlb) {
ret = -EFAULT;
break;
+ }
+ if (!msg->size) {
+ ret = -EINVAL;
+ break;
}
vhost_vq_meta_reset(dev);
vhost_iotlb_del_range(dev->iotlb, msg->iova,
--
2.39.3
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] vhost: reject zero-size IOTLB INVALIDATE
2026-07-16 3:02 Weimin Xiong
@ 2026-07-16 9:41 ` Eugenio Perez Martin
2026-07-17 1:29 ` Weimin Xiong
0 siblings, 1 reply; 4+ messages in thread
From: Eugenio Perez Martin @ 2026-07-16 9:41 UTC (permalink / raw)
To: Weimin Xiong; +Cc: virtualization, mst, jasowangio, netdev, kvm, xiongweimin
On Thu, Jul 16, 2026 at 5:02 AM Weimin Xiong <xiongwm2026@163.com> wrote:
>
> From: xiongweimin <xiongweimin@kylinos.cn>
>
> Reject VHOST_IOTLB_INVALIDATE messages with size == 0 to prevent
> iova + size - 1 from underflowing to U64_MAX, which would
> incorrectly delete the entire IOTLB.
>
> Signed-off-by: xiongweimin <xiongweimin@kylinos.cn>
> ---
> drivers/vhost/vhost.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> index 3c080c454e374cabd7321416ed92c5f7d3135254..xxxxxxxxxx 100644
> --- a/drivers/vhost/vhost.c
> +++ b/drivers/vhost/vhost.c
> @@ -1656,6 +1656,10 @@ static int vhost_process_iotlb_msg(struct vhost_dev *dev, u32 asid,
> if (!dev->iotlb) {
> ret = -EFAULT;
> break;
> + }
> + if (!msg->size) {
> + ret = -EINVAL;
> + break;
> }
I think the issue is real, but how about adding the condition to the
caller vhost_chr_write_iter? It is already the
if (msg.type == VHOST_IOTLB_UPDATE && msg.size == 0) {
ret = -EINVAL;
goto done;
}
So it should be somthing in the line of:
if ((msg.type == VHOST_IOTLB_UPDATE || msg.type ==
VHOST_IOTLB_INVALIDATE) && msg.size == 0) {
ret = -EINVAL;
goto done;
}
With that, please add my acked-by.
> vhost_vq_meta_reset(dev);
> vhost_iotlb_del_range(dev->iotlb, msg->iova,
> --
> 2.39.3
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] vhost: reject zero-size IOTLB INVALIDATE
2026-07-16 9:41 ` Eugenio Perez Martin
@ 2026-07-17 1:29 ` Weimin Xiong
0 siblings, 0 replies; 4+ messages in thread
From: Weimin Xiong @ 2026-07-17 1:29 UTC (permalink / raw)
To: Eugenio Perez Martin
Cc: virtualization, mst, jasowangio, netdev, kvm, xiongweimin
From: xiongweimin <xiongweimin@kylinos.cn>
Hi Eugenio,
Thank you for your review and suggestion!
I've updated the patch to v2, moving the check to vhost_chr_write_iter
as you suggested. The existing check for VHOST_IOTLB_UPDATE is now extended
to also cover VHOST_IOTLB_INVALIDATE.
Thanks for your Acked-by!
Best regards,
Weimin Xiong
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-07-17 1:30 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-16 3:00 [PATCH] vhost: reject zero-size IOTLB INVALIDATE Weimin Xiong
-- strict thread matches above, loose matches on Subject: below --
2026-07-16 3:02 Weimin Xiong
2026-07-16 9:41 ` Eugenio Perez Martin
2026-07-17 1:29 ` Weimin Xiong
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox