In the Linux kernel, the following vulnerability has been resolved:
vdpasimblk: set number of address spaces and virtqueue groups
Commit bda324fd037a ("vdpasim: control virtqueue support") added two new fields (nas, ngroups) to vdpasimdevattr, but we forgot to initialize them for vdpasimblk.
When creating a new vdpasimblk device this causes the kernel to panic in this way: $ vdpa dev add mgmtdev vdpasimblk name blk0 BUG: kernel NULL pointer dereference, address: 0000000000000030 ... RIP: 0010:vhostiotlbaddrangectx+0x41/0x220 [vhostiotlb] ... Call Trace: <TASK> vhostiotlbaddrange+0x11/0x800 [vhostiotlb] vdpasimmaprange+0x91/0xd0 [vdpasim] vdpasimalloccoherent+0x56/0x90 [vdpasim] ...
This happens because vdpasim->iommu[0] is not initialized when dev_attr.nas is 0.
Let's fix this issue by initializing both (nas, ngroups) to 1 for vdpasimblk.