Re: [BUG] scsi: short virtio-scsi VPD response exposes stale heap data

[Michael S. Tsirkin]

On Tue, Oct 06, 2026 at 06:40:54PM +0900, 성병찬 wrote:
> Yes, that is a fair summary.
> 
> More precisely, a short successful virtio-scsi response causes the
> guest kernel to cache bytes that were not supplied by the device and
> expose them through the world-readable VPD sysfs attribute.
> 
> The guest-kernel heap disclosure is reproducible. I agree that its
> security classification depends on whether the virtio-scsi
> device/backend is considered trusted in the relevant threat model.
> 
> Would validating and propagating the actual virtqueue used length be
> worthwhile as a robustness fix?
> 
> Regards,
> sungbyeongchan
> 

I think so but please copy all relevant maintainers.

 ./scripts/get_maintainer.pl -f drivers/scsi/virtio_scsi.c
"Michael S. Tsirkin" <mst@xxxxxxxxxx> (maintainer:VIRTIO BLOCK AND SCSI DRIVERS)
Jason Wang <jasowangio@xxxxxxxxx> (maintainer:VIRTIO BLOCK AND SCSI DRIVERS)
Paolo Bonzini <pbonzini@xxxxxxxxxx> (reviewer:VIRTIO BLOCK AND SCSI DRIVERS)
Stefan Hajnoczi <stefanha@xxxxxxxxxx> (reviewer:VIRTIO BLOCK AND SCSI DRIVERS)
"Eugenio Pérez" <eperezma@xxxxxxxxxx> (reviewer:VIRTIO BLOCK AND SCSI DRIVERS)
"James E.J. Bottomley" <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx> (maintainer:SCSI SUBSYSTEM)
"Martin K. Petersen" <mkp@xxxxxxxxxx> (maintainer:SCSI SUBSYSTEM)
virtualization@xxxxxxxxxxxxxxx (open list:VIRTIO BLOCK AND SCSI DRIVERS)
linux-scsi@xxxxxxxxxxxxxxx (open list:SCSI SUBSYSTEM)
linux-kernel@xxxxxxxxxxxxxxx (open list)


-- 
MST