Re: [PATCH] vhost: reject invalid IOTLB update permissions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing validation for `msg.size == 0` during `VHOST_IOTLB_INVALIDATE` leads to integer underflow and unintended interval tree queries.
--

commit b0f07892733bab641caa79a8f76f81c291b22034
Author: Linfeng Sun <linfeng.sun.dev@gmail.com>

vhost: reject invalid IOTLB update permissions

This commit adds validation for the permission field of IOTLB update
messages in vhost_chr_write_iter(). It rejects messages with empty or
invalid permissions to prevent warnings when these are dispatched to the
vDPA backend.

> diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
> index 44cac11b68d2a..0adf0fea97b41 100644
> --- a/drivers/vhost/vhost.c
> +++ b/drivers/vhost/vhost.c
> @@ -1750,7 +1750,8 @@ ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
>  		goto done;
>  	}
>  
> -	if (msg.type == VHOST_IOTLB_UPDATE && msg.size == 0) {
> +	if (msg.type == VHOST_IOTLB_UPDATE &&
> +	    (!msg.size || !msg.perm || (msg.perm & ~VHOST_ACCESS_RW))) {
>  		ret = -EINVAL;
>  		goto done;
>  	}

[Severity: High]
This is a pre-existing issue, but since we are validating message sizes
here, is there a missing size == 0 check for VHOST_IOTLB_INVALIDATE messages
that can lead to an integer underflow?

If a userspace process sends a VHOST_IOTLB_INVALIDATE message with size == 0,
the generic vhost_process_iotlb_msg() handler explicitly checks for this and
returns -EINVAL. However, the custom vDPA handler does not:

drivers/vhost/vdpa.c:vhost_vdpa_process_iotlb_msg() {
    ...
	case VHOST_IOTLB_INVALIDATE:
		vhost_vdpa_unmap(v, iotlb, msg->iova, msg->size);
		break;
    ...
}

This gets passed to vhost_vdpa_unmap() which performs this calculation:

drivers/vhost/vdpa.c:vhost_vdpa_unmap() {
    ...
	vhost_vdpa_iotlb_unmap(v, iotlb, iova, iova + size - 1, asid);
    ...
}

Does this calculation underflow when size is 0? 

If iova == 0, the last index (iova + size - 1) would wrap to ULLONG_MAX,
silently unmapping the entire IOTLB. If iova > 0, it creates an inverted
interval where start > last. The interval tree incorrectly handles this by
finding and unmapping any valid intervals that straddle both start and last,
corrupting the device's internal tree representation.

Should we add a similar size == 0 check for VHOST_IOTLB_INVALIDATE either
here in vhost_chr_write_iter() or directly inside
vhost_vdpa_process_iotlb_msg()?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260913-fix-vhost_chr_write_iter-v1-1-76bf1f436cfe@gmail.com?part=1