From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 47EEB80E7E for ; Thu, 29 Oct 2026 13:49:46 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69TDmR8R000563; Thu, 29 Oct 2026 16:48:28 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69TDmR8R000563 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="ui1yIUP8" Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69TDmPpl000559 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Thu, 29 Oct 2026 16:48:26 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69TDmPpl000559 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-49febef74e3so5284465e9.0 for ; Thu, 29 Oct 2026 06:48:25 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBzj5REkktNF8irqMNZlyix2cMRtqQ/PliJrteEkBJVdsjcbpxhn0+FDiD/vhvdNheIBVIXjBg==@openvz.org X-Gm-Message-State: AFq9FYIvHvUN0QWUaeoSXfz8mZUKZ9l/wKuLIlKJD3GbbDN6mQ+nb9u1 sp7bRAgKB4KBzY5qXNIXXy8DkaXDtP1lU6nie2a0L6udxzllBTfICaD/b5hoJ+Zdrrm0W214Gmb oBnlHJWOxz1H5aPEDgp53euPBnt/QrKOLFR+RyfUk1oJ5cMAruOFhRA== X-Gm-Gg: AYBFou2XJUFTcs3GFMB+zXJg+UzAAqqCz/wNcIFSvYf00byu3dFm6HC0qViEcjnxVxH EMUrg+EhYeA87EiQWZ3NINnCEWFxOP2cYzMoI8L2ZcitQ/q+iePErRAp3KJKMOTiNT5qS8pkix0 T/Hpp6ZHQVrzF7jQAPV2WYhjRYbD5Cw4eqJeB5OBJInUyeDfFm6zxcjno7ANvh/o+RW8vIXpxL9 QBuIlIj1KW1ZZEHqwt8KRfWH5H9gmYnhogLqkfvU8cGkXSNwbR7WZmEwdYsdkIWNs23SM54abgn 9+xxgN2XHQPhH1vuiAH02fnZTjilm1yKDAEK1ExgEkF3VeA0qBRB5I5m4HyJUnFso5ja1MXqCuU ePyRD7P2HMcPgGrefLocolyQqcpzW X-Received: by 2002:a05:600d:1a:b0:4a1:d49e:9ce with SMTP id 5b1f17b1804b1-4aa86e16223mr64721335e9.2.1793281705571; Thu, 29 Oct 2026 06:48:25 -0700 (PDT) X-Received: by 2002:a05:600d:1a:b0:4a1:d49e:9ce with SMTP id 5b1f17b1804b1-4aa86e16223mr64720775e9.2.1793281705070; Thu, 29 Oct 2026 06:48:25 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793281705; cv=none; d=google.com; s=arc-20260327; b=i5HtUDSyACLd0uf85mBxuP/N3dMz8Eo5yCNUK+/2GcbespAtTwvppWH82UgEtf2Na5 s/XrNMPQFHovKfe9Jn5dPXDNYKtix+8UOYipS3Cz13i/ax8ridQ0AC04PEKmEHArNEXu aEedi/HTOOZnE5M1eNpz+GynIVqOmTd8fKoqWCRem5l9AQqT9e9B2lumYLhnA/qoFwsi HbL3oZzXUhAbYT8Dk1C4PV1rEKvc25VyCrTnbkWTY1Hn7hZboGSTAQMHHim/dzdDYtw5 Ll/nqmSJeSJ13v/34t5FSJYN5YA60rt3vkfzJmJHDBUgzaegKnHNhfF/fEtKWm08XjGo Y+hg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:dkim-signature; bh=KMT2f99tSQi3Y6WYrFuR9QKyF8j4rG6/Bli/ENQ4gbA=; fh=CMILZ+goaghq6B4UpCDhf0EQp6kYD0LAlmOkUiVCOvs=; b=JvvZiUPXXDiCAkuL5HtximQszIZk+x1nxH3co+/mLfv3NLFzbtZzmjkr4vKDiNDJws qQNC2bVWLLbX/NN0lud9bwSt9XrWD90zsToFR9G7XrLCxm6m/1TPxUMmzH9R4a3PJGRY tSr4hembM951VSmAJeCvEL2TxBmArq6YVFWG76FDzxMYrJk2WXvLRw0BODE0LPANH9Oj XTJJIBEEdEBc3boessKdAOOGbp2D3NzE46riEyz7Cr1CeJT5qnkwcSR0ndXVYdEmokaU 7QIG3nUTQGdiQP3QdN36mWpjKdwc2UIkAhhB2a5L+UULUsQ/Tql2Ifadsq5AJsXFJ/NQ W9Ag==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=ui1yIUP8; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e3ed1e79fsi33240200f8f.420.2026.10.29.06.48.24 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Oct 2026 06:48:24 -0700 (PDT) Received-SPF: pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=ui1yIUP8; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=KMT2f99tSQi3Y6WYrFuR9QKyF8j4rG6/Bli/ENQ4gbA=; b=ui1yIUP8ovSQ 45aYgHE1M39qqer9hIpV0CJ0u/8Itq8+66kB+QEEZGaBFkogB2zTtF7O9k0KOKx5hrHBMgq/0xJuU 852UtGcFqvY0fcDTTU3goYh3JWzfgYNhFkxctsvxqqEqqlfBn8b2ZMDDXtEo56dJ1oX14bcA4Fp0Y FRhK4Pg1TZLtTTUZ+QR5biBxt+8ADWUvdeyQ6r3F9zvz/LUIrVdJCnmzaypdmx/dPyCPJpfDie29B sNzHmvdTka+6D4tKqLK/2DnyRqL3pCvx93ZXgcgWs//JEBJNOdxKV9+exGBxbYgabDhYU/8USPMux 4Ix8m4sdRXaONkKf0cky6Q==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=sky) by relay.virtuozzo.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xMQQe-006NtP-2n; Thu, 29 Oct 2026 14:48:22 +0100 From: Alexander Ivanov To: andrey.zhadchenko@virtuozzo.com Date: Thu, 29 Oct 2026 14:48:22 +0100 Message-ID: <20261029134822.3367197-1-alexander.ivanov@virtuozzo.com> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v2] drivers/vhost/blk: reject a head that is still in flight X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org vhost_blk_req_handle() takes the request slot by head and overwrites it without checking that it is free. A guest that puts a head into the avail ring again while its request is in flight makes the slot get submitted twice: req_inflight is raised for each submission, but the completion path sees one slot and calls forget_request() once. req_inflight never drops to zero, and vhost_blk_flush() on backend drop leaves QEMU in D state forever with the block device pinned. The second submission also overwrites bio[], bio_nr and the iovecs of bios that are still in flight, and frees the bounce buffer and bio[] of the first submission under them, which is a use-after-free. Mark a slot in flight from bio submission until its completion is handled, both under vq->mutex, and fail the request if the guest posts an in-flight head. Log the head and let the caller report the error on the vq error eventfd and stop processing the ring. Allocate the slots zeroed so the flag starts clear. Fixes: d8722ff88c5d ("drivers/vhost: vhost-blk accelerator for virtio-blk guests") Feature: vhost-blk: in-kernel accelerator for virtio-blk guests Signed-off-by: Alexander Ivanov --- v2: - note that the second submission frees buffers under in-flight bios (use-after-free) - log the reused head with vhostblk_vq_err() drivers/vhost/blk.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c index b170439a1806..aa646a598586 100644 --- a/drivers/vhost/blk.c +++ b/drivers/vhost/blk.c @@ -79,6 +79,7 @@ struct vhost_blk_req { u16 head; size_t len; int bio_err; + bool inflight; struct vhost_blk *blk; struct vhost_blk_vq *blk_vq; @@ -434,6 +435,7 @@ static int vhost_blk_req_submit(struct vhost_blk_req *req) if (ret < 0) goto out; + req->inflight = true; vhost_blk_bio_send(req); return ret; @@ -457,6 +459,11 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq, u8 status; req = &blk_vq->req[head]; + if (unlikely(req->inflight)) { + vhostblk_vq_err(blk, vq, "Guest reused in-flight head %d", head); + return -EBUSY; + } + req->blk_vq = blk_vq; req->head = head; req->blk = blk; @@ -628,6 +635,7 @@ static void vhost_blk_handle_host_kick(struct vhost_work *work) added = true; } + req->inflight = false; forget_request(req); } @@ -703,8 +711,8 @@ static int vhost_blk_setup_vqs(struct vhost_blk *blk) if (!vhost_vq_is_setup(vq)) continue; - blk->vqs[i].req = kvmalloc_array(vq->num, sizeof(struct vhost_blk_req), - GFP_KERNEL); + blk->vqs[i].req = kvcalloc(vq->num, sizeof(struct vhost_blk_req), + GFP_KERNEL); if (!blk->vqs[i].req) return -ENOMEM; -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel