vhost_vring_set_num() only requires a non-zero power-of-two that fits in 16 bits. vhost-vdpa then hands that value to the backend through set_vq_num() without comparing it to get_vq_num_max(). A local process with access to /dev/vhost-vdpa-* can therefore set a queue size larger than the device advertises. On the vdpa_sim backend, the worker then walks descriptors beyond the mapped descriptor ring. KASAN reports a 16-byte out-of-bounds read, corresponding to one vring_desc, in the vringh IOTLB path: BUG: KASAN: out-of-bounds in _copy_from_iter Read of size 16 copy_from_iotlb copydesc_iotlb vringh_getdesc_iotlb vdpasim_net_work Check the requested size against get_vq_num_max() in vhost_vdpa_vring_ioctl() before calling vhost_vring_ioctl(), and return -EINVAL when the request is too large. Fixes: 4c8cf31885f6 ("vhost: introduce vDPA-based backend") Signed-off-by: Jia Jia --- v2: - Add the missing Signed-off-by tag. drivers/vhost/vdpa.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index ac55275fa0d0..b2083e1ef150 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -716,6 +716,13 @@ static long vhost_vdpa_vring_ioctl(struct vhost_vdpa *v, unsigned int cmd, vhost_vdpa_unsetup_vq_irq(v, idx); } break; + case VHOST_SET_VRING_NUM: + /* Reject sizes above the max reported by the device. */ + if (copy_from_user(&s, argp, sizeof(s))) + return -EFAULT; + if (s.num > ops->get_vq_num_max(vdpa)) + return -EINVAL; + break; } r = vhost_vring_ioctl(&v->vdev, cmd, argp); -- 2.34.1