From: Si-Wei Liu <si-wei.liu@oracle.com> stable inclusion from stable-v6.6.158 commit bd94e2ba56d0236fd199604551aa15a55b6df6f3 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/19814 CVE: CVE-2026-97994 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit bc91df5c70ac720eca18bd1f4a288f2582713d3e ] Using .compat_reset op from the previous patch, the buggy .reset behaviour can be kept as-is on older userspace apps, which don't ack the IOTLB_PERSIST backend feature. As this compatibility quirk is limited to those drivers that used to be buggy in the past, it won't affect change the behaviour or affect ABI on the setups with API compliant driver. The separation of .compat_reset from the regular .reset allows vhost-vdpa able to know which driver had broken behaviour before, so it can apply the corresponding compatibility quirk to the individual driver whenever needed. Compared to overloading the existing .reset with flags, .compat_reset won't cause any extra burden to the implementation of every compliant driver. [mst: squashed in two fixup commits] Message-Id: <1697880319-4937-6-git-send-email-si-wei.liu@oracle.com> Message-Id: <1698102863-21122-1-git-send-email-si-wei.liu@oracle.com> Reported-by: Dragos Tatulea <dtatulea@nvidia.com> Tested-by: Dragos Tatulea <dtatulea@nvidia.com> Message-Id: <1698275594-19204-1-git-send-email-si-wei.liu@oracle.com> Reported-by: Lei Yang <leiyang@redhat.com> Signed-off-by: Si-Wei Liu <si-wei.liu@oracle.com> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Tested-by: Lei Yang <leiyang@redhat.com> Stable-dep-of: ccb1dc7c527f ("vhost/vdpa: reject VRING_NUM larger than device max") Signed-off-by: Sasha Levin <sashal@kernel.org> Conflicts: drivers/vhost/vdpa.c drivers/virtio/virtio_vdpa.c include/linux/vdpa.h [1. Context conflicts. 2. This tree carries a private reset-state extension (enum vdpa_reset_state, reset op taking @state). The upstream compat reset flags and the local reset state share the same parameter slot, so vdpa_reset() and _compat_vdpa_reset() are extended to take both: the upstream @flags come first, the local @state is kept as the last argument. compat_reset() itself only receives @flags, and no driver in this tree implements it, so ops->compat_reset is always NULL and the reset op keeps receiving @state exactly as before.] Signed-off-by: Jiacheng Yu <yujiacheng3@huawei.com> --- drivers/vhost/vdpa.c | 20 ++++++++++++++++---- drivers/virtio/virtio_vdpa.c | 2 +- include/linux/vdpa.h | 7 +++++-- 3 files changed, 22 insertions(+), 7 deletions(-) diff --git a/drivers/vhost/vdpa.c b/drivers/vhost/vdpa.c index 2fffd45830d4..c652b26d65fc 100644 --- a/drivers/vhost/vdpa.c +++ b/drivers/vhost/vdpa.c @@ -221,13 +221,24 @@ static void vhost_vdpa_unsetup_vq_irq(struct vhost_vdpa *v, u16 qid) irq_bypass_unregister_producer(&vq->call_ctx.producer); } -static int vhost_vdpa_reset(struct vhost_vdpa *v, int state) +static int _compat_vdpa_reset(struct vhost_vdpa *v, int state) { struct vdpa_device *vdpa = v->vdpa; + u32 flags = 0; - v->in_batch = 0; + if (v->vdev.vqs) { + flags |= !vhost_backend_has_feature(v->vdev.vqs[0], + VHOST_BACKEND_F_IOTLB_PERSIST) ? + VDPA_RESET_F_CLEAN_MAP : 0; + } + + return vdpa_reset(vdpa, flags, state); +} - return vdpa_reset(vdpa, state); +static int vhost_vdpa_reset(struct vhost_vdpa *v, int state) +{ + v->in_batch = 0; + return _compat_vdpa_reset(v, state); } static long vhost_vdpa_bind_mm(struct vhost_vdpa *v) @@ -306,7 +317,7 @@ static long vhost_vdpa_set_status(struct vhost_vdpa *v, u8 __user *statusp) vhost_vdpa_unsetup_vq_irq(v, i); if (status == 0) { - ret = vdpa_reset(vdpa, VDPA_DEV_RESET_VIRTIO); + ret = _compat_vdpa_reset(v, VDPA_DEV_RESET_VIRTIO); if (ret) return ret; } else @@ -1658,6 +1669,7 @@ static void vhost_vdpa_cleanup(struct vhost_vdpa *v) vhost_vdpa_free_domain(v); vhost_dev_cleanup(&v->vdev); kfree(v->vdev.vqs); + v->vdev.vqs = NULL; } static int vhost_vdpa_open(struct inode *inode, struct file *filep) diff --git a/drivers/virtio/virtio_vdpa.c b/drivers/virtio/virtio_vdpa.c index 5e2b1bb4d009..0d767b9a16e8 100644 --- a/drivers/virtio/virtio_vdpa.c +++ b/drivers/virtio/virtio_vdpa.c @@ -100,7 +100,7 @@ static void virtio_vdpa_reset(struct virtio_device *vdev) { struct vdpa_device *vdpa = vd_get_vdpa(vdev); - vdpa_reset(vdpa, VDPA_DEV_RESET_VIRTIO); + vdpa_reset(vdpa, 0, VDPA_DEV_RESET_VIRTIO); } static bool virtio_vdpa_notify(struct virtqueue *vq) diff --git a/include/linux/vdpa.h b/include/linux/vdpa.h index 32528aae815a..216186f27474 100644 --- a/include/linux/vdpa.h +++ b/include/linux/vdpa.h @@ -565,14 +565,17 @@ static inline struct device *vdpa_get_dma_dev(struct vdpa_device *vdev) return vdev->dma_dev; } -static inline int vdpa_reset(struct vdpa_device *vdev, int state) +static inline int vdpa_reset(struct vdpa_device *vdev, u32 flags, int state) { const struct vdpa_config_ops *ops = vdev->config; int ret; down_write(&vdev->cf_lock); vdev->features_valid = false; - ret = ops->reset(vdev, state); + if (ops->compat_reset && flags) + ret = ops->compat_reset(vdev, flags); + else + ret = ops->reset(vdev, state); up_write(&vdev->cf_lock); return ret; } -- 2.34.1