On 3/17/25 6:55 PM, Dongli Zhang wrote: > The vhost-scsi completion path may access vq->log_base when vq->log_used is > already set to false. > > vhost-thread QEMU-thread > > vhost_scsi_complete_cmd_work() > -> vhost_add_used() > -> vhost_add_used_n() > if (unlikely(vq->log_used)) > QEMU disables vq->log_used > via VHOST_SET_VRING_ADDR. > mutex_lock(&vq->mutex); > vq->log_used = false now! > mutex_unlock(&vq->mutex); > > QEMU gfree(vq->log_base) > log_used() > -> log_write(vq->log_base) > > Assuming the VMM is QEMU. The vq->log_base is from QEMU userpace and can be > reclaimed via gfree(). As a result, this causes invalid memory writes to > QEMU userspace. > > The control queue path has the same issue. > > Signed-off-by: Dongli Zhang <dongli.zhang@xxxxxxxxxx> > --- Reviewed-by: Mike Christie <michael.christie@xxxxxxxxxx>
