[PATCH] virtio_ring: Initialize id field in packed indirect descriptors

[PATCH] virtio_ring: Initialize id field in packed indirect descriptors

[zhangjiao2]

From: zhang jiao <zhangjiao2@cmss.chinamobile.com>

The virtqueue_add_indirect_packed() function fills an indirect
descriptor table with addr, len, and flags for each entry, but does
not initialize the id field of struct vring_packed_desc. The table is
allocated via kmalloc() (not kzalloc) and then DMA-mapped with
DMA_TO_DEVICE, making the uninitialized 2-byte id field of each
descriptor readable by the device.

This leaks kernel heap memory to the device for every packed indirect
descriptor entry. A malicious or compromised device could extract heap
contents by reading the id fields from the DMA-mapped indirect
descriptor tables. This affects all virtio devices that use packed
virtqueues with indirect descriptors, which is the common configuration
for modern virtio devices.

Fix this by explicitly initializing desc[i].id to zero in the
descriptor filling loop. The id field is unused in indirect descriptor
table entries per the virtio specification (only the head descriptor in
the main ring uses id for buffer identification), so setting it to zero
is semantically correct.

This matches the split ring path where all four fields of struct
vring_desc (addr, len, flags, next) are explicitly written in
virtqueue_add_desc_split().

Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>
---
 drivers/virtio/virtio_ring.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 5c169fbb418a..42883b01fab0 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -1571,6 +1571,11 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq,
 						0 : VRING_DESC_F_WRITE);
 			desc[i].addr = cpu_to_le64(addr);
 			desc[i].len = cpu_to_le32(len);
+			/* The id field is unused in indirect descriptors but
+			 * must be initialized to prevent leaking kernel heap
+			 * memory to the device through the DMA-mapped table.
+			 */
+			desc[i].id = 0;
 
 			if (unlikely(vq->use_map_api)) {
 				extra[i].addr = premapped ? DMA_MAPPING_ERROR : addr;
-- 
2.33.0

Re: [PATCH] virtio_ring: Initialize id field in packed indirect descriptors

[Michael S. Tsirkin]

On Thu, Oct 29, 2026 at 03:25:10PM +0800, zhangjiao2 wrote:
> From: zhang jiao <zhangjiao2@cmss.chinamobile.com>
> 
> The virtqueue_add_indirect_packed() function fills an indirect
> descriptor table with addr, len, and flags for each entry, but does
> not initialize the id field of struct vring_packed_desc. The table is
> allocated via kmalloc() (not kzalloc) and then DMA-mapped with
> DMA_TO_DEVICE, making the uninitialized 2-byte id field of each
> descriptor readable by the device.
> 
> This leaks kernel heap memory to the device for every packed indirect
> descriptor entry. A malicious or compromised device could extract heap
> contents by reading the id fields from the DMA-mapped indirect
> descriptor tables. This affects all virtio devices that use packed
> virtqueues with indirect descriptors, which is the common configuration
> for modern virtio devices.
> 
> Fix this by explicitly initializing desc[i].id to zero in the
> descriptor filling loop. The id field is unused in indirect descriptor
> table entries per the virtio specification (only the head descriptor in
> the main ring uses id for buffer identification), so setting it to zero
> is semantically correct.
> 
> This matches the split ring path where all four fields of struct
> vring_desc (addr, len, flags, next) are explicitly written in
> virtqueue_add_desc_split().
> 
> Signed-off-by: zhang jiao <zhangjiao2@cmss.chinamobile.com>

This is defnitely not trivial material.
Pls report to the proper list in the future.

> ---
>  drivers/virtio/virtio_ring.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
> index 5c169fbb418a..42883b01fab0 100644
> --- a/drivers/virtio/virtio_ring.c
> +++ b/drivers/virtio/virtio_ring.c
> @@ -1571,6 +1571,11 @@ static int virtqueue_add_indirect_packed(struct vring_virtqueue *vq,
>  						0 : VRING_DESC_F_WRITE);
>  			desc[i].addr = cpu_to_le64(addr);
>  			desc[i].len = cpu_to_le32(len);
> +			/* The id field is unused in indirect descriptors but
> +			 * must be initialized to prevent leaking kernel heap
> +			 * memory to the device through the DMA-mapped table.
> +			 */



> +			desc[i].id = 0;
>  
>  			if (unlikely(vq->use_map_api)) {
>  				extra[i].addr = premapped ? DMA_MAPPING_ERROR : addr;
> -- 
> 2.33.0
> 
>