aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJason Wang <jasowang@redhat.com>2018-08-07 23:43:04 -0400
committerDavid S. Miller <davem@davemloft.net>2018-08-08 12:44:39 -0400
commitb13f9c6364373a1b9f71e9846dc4fb199296f926 (patch)
tree904d5ecac4a32d9ed7408547200fcbf3a7fe1e30
parent0dcb82254d65f72333aa50ad626d1e9665ad093b (diff)
vhost: reset metadata cache when initializing new IOTLB
We need to reset metadata cache during new IOTLB initialization, otherwise the stale pointers to previous IOTLB may be still accessed which will lead a use after free. Reported-by: syzbot+c51e6736a1bf614b3272@syzkaller.appspotmail.com Fixes: f88949138058 ("vhost: introduce O(1) vq metadata cache") Signed-off-by: Jason Wang <jasowang@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/vhost/vhost.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index a502f1af4a21..ed3114556fda 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -1560,9 +1560,12 @@ int vhost_init_device_iotlb(struct vhost_dev *d, bool enabled)
1560 d->iotlb = niotlb; 1560 d->iotlb = niotlb;
1561 1561
1562 for (i = 0; i < d->nvqs; ++i) { 1562 for (i = 0; i < d->nvqs; ++i) {
1563 mutex_lock(&d->vqs[i]->mutex); 1563 struct vhost_virtqueue *vq = d->vqs[i];
1564 d->vqs[i]->iotlb = niotlb; 1564
1565 mutex_unlock(&d->vqs[i]->mutex); 1565 mutex_lock(&vq->mutex);
1566 vq->iotlb = niotlb;
1567 __vhost_vq_meta_reset(vq);
1568 mutex_unlock(&vq->mutex);
1566 } 1569 }
1567 1570
1568 vhost_umem_clean(oiotlb); 1571 vhost_umem_clean(oiotlb);