drivers/vhost/scsi.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
From: Dongli Zhang <dongli.zhang@oracle.com>
[ Upstream commit f591cf9fce724e5075cc67488c43c6e39e8cbe27 ]
The vhost-scsi completion path may access vq->log_base when vq->log_used is
already set to false.
vhost-thread QEMU-thread
vhost_scsi_complete_cmd_work()
-> vhost_add_used()
-> vhost_add_used_n()
if (unlikely(vq->log_used))
QEMU disables vq->log_used
via VHOST_SET_VRING_ADDR.
mutex_lock(&vq->mutex);
vq->log_used = false now!
mutex_unlock(&vq->mutex);
QEMU gfree(vq->log_base)
log_used()
-> log_write(vq->log_base)
Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be
reclaimed via gfree(). As a result, this causes invalid memory writes to
QEMU userspace.
The control queue path has the same issue.
CVE-2025-38074
Cc: stable@vger.kernel.org#5.10.x
Cc: gregkh@linuxfoundation.org
Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Message-Id: <20250403063028.16045-2-dongli.zhang@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Conflicts in drivers/vhost/scsi.c
bacause vhost_scsi_complete_cmd_work() has been refactored. ]
Signed-off-by: Xinyu Zheng <zhengxinyu6@huawei.com>
---
drivers/vhost/scsi.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index a23a65e7d828..fcde3752b4f1 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -579,8 +579,10 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
ret = copy_to_iter(&v_rsp, sizeof(v_rsp), &iov_iter);
if (likely(ret == sizeof(v_rsp))) {
struct vhost_scsi_virtqueue *q;
- vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0);
q = container_of(cmd->tvc_vq, struct vhost_scsi_virtqueue, vq);
+ mutex_lock(&q->vq.mutex);
+ vhost_add_used(cmd->tvc_vq, cmd->tvc_vq_desc, 0);
+ mutex_unlock(&q->vq.mutex);
vq = q - vs->vqs;
__set_bit(vq, signal);
} else
@@ -1193,8 +1195,11 @@ static void vhost_scsi_tmf_resp_work(struct vhost_work *work)
else
resp_code = VIRTIO_SCSI_S_FUNCTION_REJECTED;
+ mutex_lock(&tmf->svq->vq.mutex);
vhost_scsi_send_tmf_resp(tmf->vhost, &tmf->svq->vq, tmf->in_iovs,
tmf->vq_desc, &tmf->resp_iov, resp_code);
+ mutex_unlock(&tmf->svq->vq.mutex);
+
vhost_scsi_release_tmf_res(tmf);
}
--
2.34.1On Wed, Jul 02, 2025 at 08:29:45AM +0000, Xinyu Zheng wrote: > From: Dongli Zhang <dongli.zhang@oracle.com> > > [ Upstream commit f591cf9fce724e5075cc67488c43c6e39e8cbe27 ] > > The vhost-scsi completion path may access vq->log_base when vq->log_used is > already set to false. > > vhost-thread QEMU-thread > > vhost_scsi_complete_cmd_work() > -> vhost_add_used() > -> vhost_add_used_n() > if (unlikely(vq->log_used)) > QEMU disables vq->log_used > via VHOST_SET_VRING_ADDR. > mutex_lock(&vq->mutex); > vq->log_used = false now! > mutex_unlock(&vq->mutex); > > QEMU gfree(vq->log_base) > log_used() > -> log_write(vq->log_base) > > Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be > reclaimed via gfree(). As a result, this causes invalid memory writes to > QEMU userspace. > > The control queue path has the same issue. > > CVE-2025-38074 This is not needed. > Cc: stable@vger.kernel.org#5.10.x What about 5.15.y and 6.1.y? We can't take a patch just for 5.10 as that would cause regressions, right? Please provide all relevant backports and I will be glad to queue them up then. I'll drop this from my queue for now, thanks. greg k-h
On 7/10/2025 9:41 PM, Greg KH wrote: > On Wed, Jul 02, 2025 at 08:29:45AM +0000, Xinyu Zheng wrote: >> From: Dongli Zhang <dongli.zhang@oracle.com> >> >> [ Upstream commit f591cf9fce724e5075cc67488c43c6e39e8cbe27 ] >> >> The vhost-scsi completion path may access vq->log_base when vq->log_used is >> already set to false. >> >> vhost-thread QEMU-thread >> >> vhost_scsi_complete_cmd_work() >> -> vhost_add_used() >> -> vhost_add_used_n() >> if (unlikely(vq->log_used)) >> QEMU disables vq->log_used >> via VHOST_SET_VRING_ADDR. >> mutex_lock(&vq->mutex); >> vq->log_used = false now! >> mutex_unlock(&vq->mutex); >> >> QEMU gfree(vq->log_base) >> log_used() >> -> log_write(vq->log_base) >> >> Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be >> reclaimed via gfree(). As a result, this causes invalid memory writes to >> QEMU userspace. >> >> The control queue path has the same issue. >> >> CVE-2025-38074 > > This is not needed. > >> Cc: stable@vger.kernel.org#5.10.x > > What about 5.15.y and 6.1.y? We can't take a patch just for 5.10 as > that would cause regressions, right? > > Please provide all relevant backports and I will be glad to queue them > up then. I'll drop this from my queue for now, thanks. > > greg k-h Sorry for forgetting the 5.15.y and 6.1.y patches. I will resend it as soon as possible. Thanks for pointing out my patch format error. Xinyu Zheng
© 2016 - 2025 Red Hat, Inc.