From mboxrd@z Thu Jan 1 00:00:00 1970 From: Konstantin Khorenko Date: Tue, 25 Aug 2026 15:56:57 +0200 Subject: [Devel] [PATCH RHEL10 COMMIT] drivers/vhost/blk: harden get_id command In-Reply-To: <20260825125152.259376-2-andrey.zhadchenko@virtuozzo.com> Message-ID: <202608251356.67PDuvHW802992@f0.sw.ru> List-Id: The commit is pushed to "branch-rh10-6.12.0-211.39.1.16.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git after rh10-6.12.0-211.39.1.16.9.vz10 ------> commit 052898980e0330e6cc936ebf0f937d2431cdee61 Author: Andrey Zhadchenko Date: Tue Aug 25 15:51:48 2026 +0300 drivers/vhost/blk: harden get_id command A defensive patch. QEMU is fine with reporting empty serial and including null terminator. So we will do the same. https://virtuozzo.atlassian.net/browse/VSTOR-138640 Feature: vhost-blk: in-kernel accelerator for virtio-blk guests Signed-off-by: Andrey Zhadchenko Reviewed-by: Vasileios Almpanis Reviewed-by: Konstantin Khorenko --- drivers/vhost/blk.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c index dac03566bfca5..edd3e75873ff5 100644 --- a/drivers/vhost/blk.c +++ b/drivers/vhost/blk.c @@ -105,8 +105,6 @@ struct vhost_blk { pid_t owner_pid; }; -static int gen; - static int move_iovec(struct iovec *from, struct iovec *to, size_t len, int iov_count_from, int iov_count_to) { @@ -491,7 +489,9 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq, ret = vhost_blk_req_submit(req); break; case VIRTIO_BLK_T_GET_ID: - len = strnlen(blk->serial, VIRTIO_BLK_ID_BYTES); + len = min_t(size_t, + strnlen(blk->serial, VIRTIO_BLK_ID_BYTES) + 1, + min_t(size_t, req->len, VIRTIO_BLK_ID_BYTES)); iov_iter_init(&iter, ITER_DEST, req->iov, req->iov_nr, req->len); ret = copy_to_iter(blk->serial, len, &iter); status = ret != len ? VIRTIO_BLK_S_IOERR : VIRTIO_BLK_S_OK; @@ -688,7 +688,6 @@ static int vhost_blk_open(struct inode *inode, struct file *file) } memset(blk->serial, 0, sizeof(blk->serial)); - snprintf(blk->serial, VIRTIO_BLK_ID_BYTES, "vhost-blk%d", gen++); atomic_set(&blk->req_inflight[0], 0); atomic_set(&blk->req_inflight[1], 0);