In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost_iotlb: bound map allocation in add_range<\/p>\n
vhost_iotlb_add_range_ctx() only retires an old entry when the table
\nhas a non-zero limit, has exactly reached that limit and has
\nVHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating
\nentries after reaching their configured limit.<\/p>\n
Existing vhost devices allocate their IOTLB with max_iotlb_entries from
\nvhost.c, which defaults to 2048 and is tunable by module parameter. Use
\nthe caller-provided limit at the allocation point instead of adding a
\nseparate default in the common IOTLB helper, and reject non-positive
\nvalues in vhost paths that can report an error.<\/p>\n
Other vhost IOTLB users should not create zero-limit tables when entries
\ncan be populated from userspace or guest-controlled requests. Add
\ncaller-side max_iotlb_entries parameters for mlx5 vDPA, VDUSE and
\nvhost-vDPA. Reject non-positive VDUSE and vhost-vDPA values, and require
\nat least two entries for vdpa_sim and mlx5 vDPA paths that install
\nfull-range mappings, since those mappings are split into two IOTLB
\nentries.<\/p>\n
Handle full-range mappings in the common helper by checking that the
\nIOTLB can hold both split entries before inserting the first half. This
\navoids returning an error after leaving a half mapping behind.<\/p>\n
When the table is full, keep the existing retire behavior for retiring
\ntables and return -ENOSPC for non-retiring tables. Reuse the retired map
\nnode instead of freeing it and allocating a replacement, so a stream of
\nIOTLB updates cannot keep forcing GFP_ATOMIC allocations after the table
\nhas reached its limit. If a zero-limit IOTLB still reaches the common
\nhelper, treat it as a configuration error and return -EINVAL.<\/p>\n
I found this bug myself, though the patch was written with AI assistance.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
vhost_iotlb: bound map allocation in add_range<\/p>\n
vhost_iotlb_add_range_ctx() only retires an old entry when the table
\nhas a non-zero<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11281","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11281","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11281"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11281"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11281"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}