FAILED: patch "[PATCH] VDUSE: avoid leaking information to userspace" failed to apply to 6.18-stable tree

PATCH New [email protected] 2 participants 5 messages Jul 20 – Jul 22

Subsystems (2)

Stable branch virtio core

lore

Share & tools

lore

[email protected]

author maintainer

2026-07-20 12:13 UTC #0 lore raw

The patch below does not apply to the 6.18-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.18.y
git checkout FETCH_HEAD
git cherry-pick -x 9c1523803445ee0348f62b77793266dd981596e0
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<[email protected]>' --in-reply-to '2026072041-connected-dole-9dc1@gregkh' --subject-prefix 'PATCH 6.18.y' 'HEAD^..'

Possible dependencies:

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 9c1523803445ee0348f62b77793266dd981596e0 Mon Sep 17 00:00:00 2001
From: Jason Wang <[email protected]>
Date: Fri, 30 Jan 2026 13:07:50 +0800
Subject: [PATCH] VDUSE: avoid leaking information to userspace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The bounceing is not necessarily page aligned, so current VDUSE can leak kernel information through mapping bounce pages to userspace. Allocate bounce pages with __GFP_ZERO to avoid leaking information to userspace.

Fixes 8c773d53fb7b ("vduse: Implement an MMU-based software IOTLB")

Cc [email protected]

Signed-off-by Jason Wang <[email protected]>

Reviewed-by Xie Yongji <[email protected]>

Reviewed-by Eugenio Pérez <[email protected]>

Signed-off-by Michael S. Tsirkin <[email protected]>

Message-ID: <[email protected]>

drivers/vdpa/vdpa_user/iova_domain.c +1 -1

index 806cec32c4bc..4dc76c0d0d13 100644
@@ -124,7 +124,7 @@ static int vduse_domain_map_bounce_page(struct vduse_iova_domain *domain,
 		if (!map->bounce_page) {
 			head_map = &domain->bounce_maps[(iova & PAGE_MASK) >> BOUNCE_MAP_SHIFT];
 			if (!head_map->bounce_page) {
-				tmp_page = alloc_page(GFP_ATOMIC);
+				tmp_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
 				if (!tmp_page)
 					return -ENOMEM;
 				if (cmpxchg(&head_map->bounce_page, NULL, tmp_page))

drivers/vdpa/vdpa_user/vduse_dev.c +1 -1

index 81409a5bb09b..9ebbe6541157 100644
@@ -999,7 +999,7 @@ static void *vduse_dev_alloc_coherent(union virtio_map token, size_t size,
 	if (!token.group)
 		return NULL;
 
-	addr = alloc_pages_exact(size, flag);
+	addr = alloc_pages_exact(size, flag | __GFP_ZERO);
 	if (!addr)
 		return NULL;

Sasha Levin

maintainer

2026-07-22 16:07 UTC #1 lore raw

PATCH 1/4 vduse: return internal vq group struct as map token

From: Eugenio Pérez <[email protected]>

[ Upstream commit 02e3f7ffe2906033da73b7c7ea8180b131d0cdbc ]

Return the internal struct that represents the vq group as virtqueue map token, instead of the device. This allows the map functions to access the information per group.

At this moment all the virtqueues share the same vq group, that only can point to ASID 0. This change prepares the infrastructure for actual per-group address space handling

Acked-by Jason Wang <[email protected]>

Signed-off-by Eugenio Pérez <[email protected]>

Signed-off-by Michael S. Tsirkin <[email protected]>

Message-Id: <[email protected]>
Stable-dep-of: 9c1523803445 ("VDUSE: avoid leaking information to userspace")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/vdpa/vdpa_user/iova_domain.c |  21 ++----
 drivers/vdpa/vdpa_user/iova_domain.h |   5 +-
 drivers/vdpa/vdpa_user/vduse_dev.c   | 109 +++++++++++++++++++++++----
 include/linux/virtio.h               |   6 +-
 4 files changed, 108 insertions(+), 33 deletions(-)

drivers/vdpa/vdpa_user/iova_domain.c +7 ~~-14~~

index 4352b5cf74f078..58a94f81175fd6 100644
@@ -493,17 +493,15 @@ void vduse_domain_unmap_page(struct vduse_iova_domain *domain,
 	vduse_domain_free_iova(iovad, dma_addr, size);
 }
 
-void *vduse_domain_alloc_coherent(struct vduse_iova_domain *domain,
-				  size_t size, dma_addr_t *dma_addr,
-				  gfp_t flag)
+dma_addr_t vduse_domain_alloc_coherent(struct vduse_iova_domain *domain,
+				       size_t size, void *orig)
 {
 	struct iova_domain *iovad = &domain->consistent_iovad;
 	unsigned long limit = domain->iova_limit;
 	dma_addr_t iova = vduse_domain_alloc_iova(iovad, size, limit);
-	void *orig = alloc_pages_exact(size, flag);
 
-	if (!iova || !orig)
-		goto err;
+	if (!iova)
+		return DMA_MAPPING_ERROR;
 
 	spin_lock(&domain->iotlb_lock);
 	if (vduse_iotlb_add_range(domain, (u64)iova, (u64)iova + size - 1,

@@ -514,17 +512,12 @@ void *vduse_domain_alloc_coherent(struct vduse_iova_domain *domain,
 	}
 	spin_unlock(&domain->iotlb_lock);
 
-	*dma_addr = iova;
+	return iova;
 
-	return orig;
 err:
-	*dma_addr = DMA_MAPPING_ERROR;
-	if (orig)
-		free_pages_exact(orig, size);
-	if (iova)
-		vduse_domain_free_iova(iovad, iova, size);
+	vduse_domain_free_iova(iovad, iova, size);
 
-	return NULL;
+	return DMA_MAPPING_ERROR;
 }
 
 void vduse_domain_free_coherent(struct vduse_iova_domain *domain, size_t size,

drivers/vdpa/vdpa_user/iova_domain.h +2 -3

index 775cad5238f3aa..153b8c24c47769 100644
@@ -67,9 +67,8 @@ void vduse_domain_unmap_page(struct vduse_iova_domain *domain,
 			     dma_addr_t dma_addr, size_t size,
 			     enum dma_data_direction dir, unsigned long attrs);
 
-void *vduse_domain_alloc_coherent(struct vduse_iova_domain *domain,
-				  size_t size, dma_addr_t *dma_addr,
-				  gfp_t flag);
+dma_addr_t vduse_domain_alloc_coherent(struct vduse_iova_domain *domain,
+				       size_t size, void *orig);
 
 void vduse_domain_free_coherent(struct vduse_iova_domain *domain, size_t size,
 				void *vaddr, dma_addr_t dma_addr,

drivers/vdpa/vdpa_user/vduse_dev.c +96 ~~-13~~

219 lines not on this page · raw message

include/linux/virtio.h +3 -3

index 132a474e59140a..d3f723b875a784 100644
@@ -41,13 +41,13 @@ struct virtqueue {
 	void *priv;
 };
 
-struct vduse_iova_domain;
+struct vduse_vq_group;
 
 union virtio_map {
 	/* Device that performs DMA */
 	struct device *dma_dev;
-	/* VDUSE specific mapping data */
-	struct vduse_iova_domain *iova_domain;
+	/* VDUSE specific virtqueue group for doing map */
+	struct vduse_vq_group *group;
 };
 
 int virtqueue_add_outbuf(struct virtqueue *vq,

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-07-22 16:07 UTC #2 lore raw

PATCH 2/4 vduse: remove unused vaddr parameter of vduse_domain_free_coherent

From: Eugenio Pérez <[email protected]>

[ Upstream commit 766e1749c0ef6a09651be9b8a8283d508c322b58 ]

We will modify the function in next patches so let's clean it first.

Signed-off-by Eugenio Pérez <[email protected]>

Signed-off-by Michael S. Tsirkin <[email protected]>

Message-Id: <[email protected]>
Stable-dep-of: 9c1523803445 ("VDUSE: avoid leaking information to userspace")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/vdpa/vdpa_user/iova_domain.c | 3 +--
 drivers/vdpa/vdpa_user/iova_domain.h | 3 +--
 drivers/vdpa/vdpa_user/vduse_dev.c   | 2 +-
 3 files changed, 3 insertions(+), 5 deletions(-)

drivers/vdpa/vdpa_user/iova_domain.c +1 -2

index 58a94f81175fd6..aab730e8a31671 100644
@@ -521,8 +521,7 @@ dma_addr_t vduse_domain_alloc_coherent(struct vduse_iova_domain *domain,
 }
 
 void vduse_domain_free_coherent(struct vduse_iova_domain *domain, size_t size,
-				void *vaddr, dma_addr_t dma_addr,
-				unsigned long attrs)
+				dma_addr_t dma_addr, unsigned long attrs)
 {
 	struct iova_domain *iovad = &domain->consistent_iovad;
 	struct vhost_iotlb_map *map;

drivers/vdpa/vdpa_user/iova_domain.h +1 -2

index 153b8c24c47769..ead5ab477079b6 100644
@@ -71,8 +71,7 @@ dma_addr_t vduse_domain_alloc_coherent(struct vduse_iova_domain *domain,
 				       size_t size, void *orig);
 
 void vduse_domain_free_coherent(struct vduse_iova_domain *domain, size_t size,
-				void *vaddr, dma_addr_t dma_addr,
-				unsigned long attrs);
+				dma_addr_t dma_addr, unsigned long attrs);
 
 void vduse_domain_reset_bounce_map(struct vduse_iova_domain *domain);

drivers/vdpa/vdpa_user/vduse_dev.c +1 -1

index 530e5f988dc7c3..a549396fffb9de 100644
@@ -937,7 +937,7 @@ static void vduse_dev_free_coherent(union virtio_map token, size_t size,
 	vdev = token.group->dev;
 	domain = vdev->domain;
 
-	vduse_domain_free_coherent(domain, size, vaddr, dma_addr, attrs);
+	vduse_domain_free_coherent(domain, size, dma_addr, attrs);
 }
 
 static bool vduse_dev_need_sync(union virtio_map token, dma_addr_t dma_addr)

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-07-22 16:07 UTC #3 lore raw

PATCH 3/4 vduse: take out allocations from vduse_dev_alloc_coherent

In reply to Sasha Levin

From: Eugenio Pérez <[email protected]>

[ Upstream commit 489d76520612abf9a4ede4344349105406c91a73 ]

The function vduse_dev_alloc_coherent will be called under rwlock in next patches. Make it out of the lock to avoid increasing its fail rate.

Acked-by Jason Wang <[email protected]>

Signed-off-by Eugenio Pérez <[email protected]>

Signed-off-by Michael S. Tsirkin <[email protected]>

Message-Id: <[email protected]>
Stable-dep-of: 9c1523803445 ("VDUSE: avoid leaking information to userspace")

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/vdpa/vdpa_user/iova_domain.c | 3 ---
 drivers/vdpa/vdpa_user/vduse_dev.c   | 1 +
 2 files changed, 1 insertion(+), 3 deletions(-)

drivers/vdpa/vdpa_user/iova_domain.c +0 -3

index aab730e8a31671..0a9f668467a8df 100644
@@ -526,7 +526,6 @@ void vduse_domain_free_coherent(struct vduse_iova_domain *domain, size_t size,
 	struct iova_domain *iovad = &domain->consistent_iovad;
 	struct vhost_iotlb_map *map;
 	struct vdpa_map_file *map_file;
-	phys_addr_t pa;
 
 	spin_lock(&domain->iotlb_lock);
 	map = vhost_iotlb_itree_first(domain->iotlb, (u64)dma_addr,

@@ -538,12 +537,10 @@ void vduse_domain_free_coherent(struct vduse_iova_domain *domain, size_t size,
 	map_file = (struct vdpa_map_file *)map->opaque;
 	fput(map_file->file);
 	kfree(map_file);
-	pa = map->addr;
 	vhost_iotlb_map_free(domain->iotlb, map);
 	spin_unlock(&domain->iotlb_lock);
 
 	vduse_domain_free_iova(iovad, dma_addr, size);
-	free_pages_exact(phys_to_virt(pa), size);
 }
 
 static vm_fault_t vduse_domain_mmap_fault(struct vm_fault *vmf)

drivers/vdpa/vdpa_user/vduse_dev.c +1 -0

index a549396fffb9de..717e132ba5c64b 100644
@@ -938,6 +938,7 @@ static void vduse_dev_free_coherent(union virtio_map token, size_t size,
 	domain = vdev->domain;
 
 	vduse_domain_free_coherent(domain, size, dma_addr, attrs);
+	free_pages_exact(vaddr, size);
 }
 
 static bool vduse_dev_need_sync(union virtio_map token, dma_addr_t dma_addr)

Signature · 1 line

2.53.0

Sasha Levin

maintainer

2026-07-22 16:07 UTC #4 lore raw

PATCH 4/4 VDUSE: avoid leaking information to userspace

In reply to Sasha Levin

From: Jason Wang <[email protected]>

[ Upstream commit 9c1523803445ee0348f62b77793266dd981596e0 ]

Fixes 8c773d53fb7b ("vduse: Implement an MMU-based software IOTLB")

Cc [email protected]

Signed-off-by Jason Wang <[email protected]>

Reviewed-by Xie Yongji <[email protected]>

Reviewed-by Eugenio Pérez <[email protected]>

Signed-off-by Michael S. Tsirkin <[email protected]>

Message-ID: <[email protected]>

Signed-off-by Sasha Levin <[email protected]>

---
 drivers/vdpa/vdpa_user/iova_domain.c | 2 +-
 drivers/vdpa/vdpa_user/vduse_dev.c   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

drivers/vdpa/vdpa_user/iova_domain.c +1 -1

index 0a9f668467a8df..ec743bed361c17 100644
@@ -124,7 +124,7 @@ static int vduse_domain_map_bounce_page(struct vduse_iova_domain *domain,
 		if (!map->bounce_page) {
 			head_map = &domain->bounce_maps[(iova & PAGE_MASK) >> BOUNCE_MAP_SHIFT];
 			if (!head_map->bounce_page) {
-				tmp_page = alloc_page(GFP_ATOMIC);
+				tmp_page = alloc_page(GFP_ATOMIC | __GFP_ZERO);
 				if (!tmp_page)
 					return -ENOMEM;
 				if (cmpxchg(&head_map->bounce_page, NULL, tmp_page))

drivers/vdpa/vdpa_user/vduse_dev.c +1 -1

index 717e132ba5c64b..2ee786b7607d15 100644
@@ -907,7 +907,7 @@ static void *vduse_dev_alloc_coherent(union virtio_map token, size_t size,
 	if (!token.group)
 		return NULL;
 
-	addr = alloc_pages_exact(size, flag);
+	addr = alloc_pages_exact(size, flag | __GFP_ZERO);
 	if (!addr)
 		return NULL;

Signature · 1 line

2.53.0