CVE-2022-50738

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vhost-vdpa: fix an iotlb memory leak<br /> <br /> Before commit 3d5698793897 ("vhost-vdpa: introduce asid based IOTLB")<br /> we called vhost_vdpa_iotlb_unmap(v, iotlb, 0ULL, 0ULL - 1) during<br /> release to free all the resources allocated when processing user IOTLB<br /> messages through vhost_vdpa_process_iotlb_update().<br /> That commit changed the handling of IOTLB a bit, and we accidentally<br /> removed some code called during the release.<br /> <br /> We partially fixed this with commit 037d4305569a ("vhost-vdpa: call<br /> vhost_vdpa_cleanup during the release") but a potential memory leak is<br /> still there as showed by kmemleak if the application does not send<br /> VHOST_IOTLB_INVALIDATE or crashes:<br /> <br /> unreferenced object 0xffff888007fbaa30 (size 16):<br /> comm "blkio-bench", pid 914, jiffies 4294993521 (age 885.500s)<br /> hex dump (first 16 bytes):<br /> 40 73 41 07 80 88 ff ff 00 00 00 00 00 00 00 00 @sA.............<br /> backtrace:<br /> [] kmem_cache_alloc_trace+0x142/0x1c0<br /> [] vhost_vdpa_process_iotlb_msg+0x68c/0x901 [vhost_vdpa]<br /> [] vhost_chr_write_iter+0xc0/0x4a0 [vhost]<br /> [] vhost_vdpa_chr_write_iter+0x18/0x20 [vhost_vdpa]<br /> [] vfs_write+0x216/0x4b0<br /> [] ksys_write+0x71/0xf0<br /> [] __x64_sys_write+0x19/0x20<br /> [] do_syscall_64+0x3f/0x90<br /> [] entry_SYSCALL_64_after_hwframe+0x63/0xcd<br /> <br /> Let&amp;#39;s fix this calling vhost_vdpa_iotlb_unmap() on the whole range in<br /> vhost_vdpa_remove_as(). We move that call before vhost_dev_cleanup()<br /> since we need a valid v-&gt;vdev.mm in vhost_vdpa_pa_unmap().<br /> vhost_iotlb_reset() call can be removed, since vhost_vdpa_iotlb_unmap()<br /> on the whole range removes all the entries.<br /> <br /> The kmemleak log reported was observed with a vDPA device that has `use_va`<br /> set to true (e.g. VDUSE). This patch has been tested with both types of<br /> devices.