From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id D16A180474 for ; Wed, 28 Oct 2026 08:16:30 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69S8F4wm015883; Wed, 28 Oct 2026 11:15:04 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69S8F4wm015883 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="jP/bhxo/" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69S8F3dD015879 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Wed, 28 Oct 2026 11:15:03 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69S8F3dD015879 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-48c7fe9736eso569459f8f.0 for ; Wed, 28 Oct 2026 01:15:03 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvByioYwEJW+ZfLLUBezJyREpHP/kdygOpUG19gUzoXRCLi+X3qyjOej2Tf1AEJvtyUfZS2ogCg==@openvz.org X-Gm-Message-State: AFq9FYLBRxfYzLaef4+An7GqPRVoDpRcK4SZB9MntrkoCvNLiHZ3irwf 9FZOaSiztnW8bygkmpVqF3JQgwLLYbPTrfitMKWSKbUHKrLROVs8l7oa8XjsBRAPzJVfBW6oh9O vbxJYXPBQuP9n9fSSZFjsQTHvuRg6xRd9hkJjWHrnBV6TDd7tNQAr3Q== X-Gm-Gg: AYBFou2dASQ0R9z0g9X5IVaL9eOVmf7ko9/x3bb6mItVAwb2SdGQrhWi9yNCnLZLVy0 BdjY9X3iFlACKcsClcC+c8NHAEOotqclTIdBJ2B2ZCdKbjg44UJ9C2giDzleLtuDMmGZIFpZl5u xPKItfF4o20s0ad44UassCQQHNZ8cWVrrK3nYde369FumqiX2Ucr6uQ5Gf3ZYooTMWIs1VnoLbW B2LVilv3k2AE18FOnrF6uTAms7Rbl7sv6MaK7XAmFHOE+W+o4+OxXMTc7rssvj3CnS/FVj9zVV5 z7vVO2POvd6Um2YNKy+KO8HBRzzZB599N0q80HY2pE/452wXYPILEYwKODGOM2TEQEgwwfS3swI DsaKl/tJDj1tCH8HErIMnICV2hJs= X-Received: by 2002:a05:6000:1848:b0:48e:5e1f:9a36 with SMTP id ffacd0b85a97d-48e5e1f9a71mr2545332f8f.42.1793175302913; Wed, 28 Oct 2026 01:15:02 -0700 (PDT) X-Received: by 2002:a05:6000:1848:b0:48e:5e1f:9a36 with SMTP id ffacd0b85a97d-48e5e1f9a71mr2545275f8f.42.1793175302411; Wed, 28 Oct 2026 01:15:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793175302; cv=none; d=google.com; s=arc-20260327; b=FlImhu6UhpAzonO6jrlyYVjI3iLTUZ4lYPf98damTwE8jjHN6mAQlaJN0QrQGR5xZf MPa8HOD3grHLBzv2LyAPVqNoyJlO6TUF2AWqupmnl9axkOEOrW11z98plgM2BHXjr8GI DzM9ZBub8E314iNh34t0LxriFF8KJlekQQ3goIVB8HnCx7p06jUhKXgFEjbmWC5QxXi7 1J8V6FmX7CeVUgiuO/QxCk321hRyR3JJNRWdFG0Z01Upa4XKnvEiJnlJur84wwLSG5A7 NC6HdFe9rpGUc6dQIavKR6vGioKkf4QPPrNgt2dGcITTQuzWULOINcGJ6MSSnLaJ71m0 DKVA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=HljyrS4x1KTDK5ln8YporW70//9nn5CIEs2UHVLnO9s=; fh=CMILZ+goaghq6B4UpCDhf0EQp6kYD0LAlmOkUiVCOvs=; b=Udq3ZXlvFUAtEzmDFrdhdUO3mxxLbQkikfWVrcyZqaNTLw5mCGla4g+3E2GAq5jRFt WaYGXscLylgEF21U4cttdYYpbtqtlcBivG7w2BmZtbwExO4n4AKyO5kRvYFZp3ORLXb9 PeHa86rKIYPrJCHEHJAcHWnOZfJGTIYn/pErYELDP3qH4KsVTFutzfePHL8vr9m+LQ8z bPN8Sidvc1JNduzyGb23NFTOYTby6dtczxb8BTqF0Pemcif1SsAPrK0XDz7oNdrQ9qRl sdbKF2K7KfjtakXoiBT0PV+WS5YjM45Mwh7UkefexM2nnBfAvgRrv0sWhrCfKFmalTkr J/TA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="jP/bhxo/"; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e3ecdb0besi24843860f8f.116.2026.10.28.01.15.02 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 28 Oct 2026 01:15:02 -0700 (PDT) Received-SPF: pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="jP/bhxo/"; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=HljyrS4x1KTDK5ln8YporW70//9nn5CIEs2UHVLnO9s=; b=jP/bhxo/kfzd 4KPoi3xA7Zn/oz6vEsyzrq7tzldYfwSRyW954MpFZ/JZwayP/QmSglKmIZETYo7SAjxDbknEuz99W 3to/Onuaw/VM8e9JiP67L0fURc2Zdw1cOTLMKu+K3O1fuGrn/DVUBpxdcY7OAulKYDRxJniSNUuTs pzzkTgfbIZntuwnio2f5XVSlobh8sFjBxsS5pPRX6p9jTZraz3h4DtuJAruyUbwv16Ev9jbwt8l09 bE45jXkrCxX4Qt84iT7Da0+MeSNEuh0VsQUB8qjfk5iB9OgBQ/5kIp7HUd+QCLPu9v1NgU5YS/jZ7 d+mJ2+UC2M4PDaXhYCALBA==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=sky) by relay.virtuozzo.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xLykV-001ijl-35; Wed, 28 Oct 2026 09:15:01 +0100 From: Alexander Ivanov To: andrey.zhadchenko@virtuozzo.com Date: Wed, 28 Oct 2026 09:14:58 +0100 Message-ID: <20261028081459.3050162-1-alexander.ivanov@virtuozzo.com> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1] drivers/vhost/blk: reject a head that is still in flight X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org vhost_blk_req_handle() takes the request slot by head and overwrites it without checking that it is free. A guest that puts a head into the avail ring again while its request is in flight makes the slot get submitted twice: req_inflight is raised for each submission, but the completion path sees one slot and calls forget_request() once. req_inflight never drops to zero, and vhost_blk_flush() on backend drop leaves QEMU in D state forever with the block device pinned. The second submission also overwrites bio[], bio_nr and the iovecs of bios that are still in flight. Mark a slot in flight from bio submission until its completion is handled, both under vq->mutex, and fail the request if the guest posts an in-flight head. The caller reports the error on the vq error eventfd and stops processing the ring. Allocate the slots zeroed so the flag starts clear. https://virtuozzo.atlassian.net/browse/VSTOR-152123 Fixes: d8722ff88c5d ("drivers/vhost: vhost-blk accelerator for virtio-blk guests") Feature: vhost-blk: in-kernel accelerator for virtio-blk guests Signed-off-by: Alexander Ivanov --- drivers/vhost/blk.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c index b170439a1806..668986449373 100644 --- a/drivers/vhost/blk.c +++ b/drivers/vhost/blk.c @@ -79,6 +79,7 @@ struct vhost_blk_req { u16 head; size_t len; int bio_err; + bool inflight; struct vhost_blk *blk; struct vhost_blk_vq *blk_vq; @@ -434,6 +435,7 @@ static int vhost_blk_req_submit(struct vhost_blk_req *req) if (ret < 0) goto out; + req->inflight = true; vhost_blk_bio_send(req); return ret; @@ -457,6 +459,9 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq, u8 status; req = &blk_vq->req[head]; + if (unlikely(req->inflight)) + return -EBUSY; + req->blk_vq = blk_vq; req->head = head; req->blk = blk; @@ -628,6 +633,7 @@ static void vhost_blk_handle_host_kick(struct vhost_work *work) added = true; } + req->inflight = false; forget_request(req); } @@ -703,8 +709,8 @@ static int vhost_blk_setup_vqs(struct vhost_blk *blk) if (!vhost_vq_is_setup(vq)) continue; - blk->vqs[i].req = kvmalloc_array(vq->num, sizeof(struct vhost_blk_req), - GFP_KERNEL); + blk->vqs[i].req = kvcalloc(vq->num, sizeof(struct vhost_blk_req), + GFP_KERNEL); if (!blk->vqs[i].req) return -ENOMEM; -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel