From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (unknown [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 28161802A7 for ; Mon, 28 Sep 2026 15:26:33 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68SFPEoB010746; Mon, 28 Sep 2026 18:25:16 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68SFPEoB010746 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="Z9gF/W1p" Received: from mail-wr1-f71.google.com (mail-wr1-f71.google.com [209.85.221.71]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 68SFPCaR010740 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Mon, 28 Sep 2026 18:25:13 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 68SFPCaR010740 Received: by mail-wr1-f71.google.com with SMTP id ffacd0b85a97d-486f18da958so2217458f8f.0 for ; Mon, 28 Sep 2026 08:25:13 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvByk3jj7iUm23dBwbtJFvfs3K7fJKQOrn19GZLvLOCWW+EbdtHyPgVILKu1o9lpRANKdMGnhtw==@openvz.org X-Gm-Message-State: AFq9FYJKXxAHzR9MZ3Ax2BGsm47ezDSpxWLez/uHa9YTfsDSVot35ypO 8VwExfxsteyaE7oeg4a7QRvzLYJtuavrVXSo3EmsLIEW7VfoL+cRSpO2r1Pj7riHB01V4I4gV/L 4pnXF6BSpX04mnz/sj0vVyVx5S+oEXxlXaFSmVq7TQ3ycQ0xOe/wgig== X-Gm-Gg: AYBFou2JXf01YNKO+tO6DQEAdy1bWqn7hx1Bk5HkE+P0BiJVSMnJtVPQd/ZxilaVoeW Y+1XZrI2m7jgiTqHQdiVwLX0AUqwyzjmULQj3wE76+ftlEcnbLC+B6vhoSJgtS5Q2IM/AdCdWXc RhRWTikssoNAPLZzGIklFT97umBO9R+Ip0tTKkYCI1cv1hLvdHQw64JZSd+TMSz6Ou1Nk+av6vS /b56v7iDNsrX5G1D8rgktfiq8+OQW0lvD9sQ+PVupKVgL5QkuXOjaJrwaOGWV6KnYbRuhWJPfns e6jSoIdTmuriWrsXcxCSFLyJoyop1jKtWtV+xUYJTCz4uoDT/gDVvDIwACCRJ1MsKGoaW6Y4np+ aH45RxEwPx1e1c3kA9w== X-Received: by 2002:a05:6000:41ee:b0:488:8352:cbef with SMTP id ffacd0b85a97d-4888352cf71mr17688318f8f.9.1790609112284; Mon, 28 Sep 2026 08:25:12 -0700 (PDT) X-Received: by 2002:a05:6000:41ee:b0:488:8352:cbef with SMTP id ffacd0b85a97d-4888352cf71mr17688210f8f.9.1790609111303; Mon, 28 Sep 2026 08:25:11 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1790609111; cv=none; d=google.com; s=arc-20260327; b=XRUMPCzGK26amOucNB1KMZ6sbdg0MSgQG6AEPDAka5uVAtbQISMeX3DPR2bJqZNssx yfR84KOc7l0Fb3DGcTzXIlXzI1JHCj4XiZEXk0NC2szb3I0nb/9lQVu55dKxtDU+uNi4 xpq/o1ZpPW3lOyU7afO3e61tfydGPHlUAI1hZRCcQ8fSPXhoBxVUa/9w3OAqYPSJSejo +Eyyr7MQMNvUy1woNvZ4QztvhMeNOg2laxhzgiu3PuSkoamMo2J1WuahbQpc8gZm/7Zw 0ZCIIR5F6mbQTDmvQxpyBHWNycLey64lZ3FDcDZYVUJT77bsarSicHBpNdCoC1wkHNtC 66pQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:dkim-signature; bh=aXnAjP0ehczGJZ8hrpJmKnas57tMH61RFjPh3jPYiYw=; fh=kTRW9DjQVqCz9W6z7hHHy4oS3xTq6GzjAYjLV6AOoHc=; b=e177ILra4CiBOg9KOHYiG6PY3B4McHST9me4eV2q3ruqzjjKnc9QIOJe1vHxdIvvNR +Wb875MiRbV2gj93OhZYTyHahZcI7oIUe+DnKUzTcGxzRYLy9jMbYFBF2I8YjPZzjeDz X6XMY5azQ8ruXlFFvXU1LLe70ATBBEh26c4sXYb58WydymhcUwmBnwko2ns3uWq3QhiE Ul1+Br0ne3O//8UqGxkpIE5o2ChUD+Skss2UmDULFZ+qP0b5YISaEFUjz0jy4IunitVJ M/v46/NEWnrDWcT/ija4JkifH881p04jjTfwOqsEYClT7J7823nVr03rnogNQmoaIivc qLDA==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="Z9gF/W1p"; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-4887a8722a7si20506449f8f.372.2026.09.28.08.25.11 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Sep 2026 08:25:11 -0700 (PDT) Received-SPF: pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b="Z9gF/W1p"; spf=pass (google.com: domain of khorenko@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=khorenko@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=Message-Id:Content-Type:MIME-Version:Subject:Date :From; bh=aXnAjP0ehczGJZ8hrpJmKnas57tMH61RFjPh3jPYiYw=; b=Z9gF/W1p2wpmng3zovG NvOlCQo0WpckRqWXKm4ykAfXr+iIP511A/tydA4jt6XBJYeQx2PBJ7M1WQC0u2j8AhG3AlpkpcEKb azWZTTiXTraC/3Ph6TCcZICl8lN5fn2HUEaRGUdu6NfIkEsCtcDGM2a0l+RNYdamu+s+eIbds6fns zPELjkLC+UxcT1e+Ne0RNXAeDSyvPO4+lhG7z+tecj6dcN70QC/egtQlYKG+ZN1rX/g6TinTJUjS3 lneoiF/wG6QVZx0ynbcpv1Fsq3IuANKclb6TGDBzvOE55S6h27U8BKW7ImdpF6DrlEqFQZHQxKwD4 znMfyEdJt5DQjBw==; Received: from ch-demo-asa.virtuozzo.com ([130.117.225.8] helo=f0.sw.ru) by relay.virtuozzo.com with esmtp (Exim 4.96) (envelope-from ) id 1xBDB4-0055eh-0S; Mon, 28 Sep 2026 17:25:02 +0200 From: Konstantin Khorenko Date: Mon, 28 Sep 2026 17:25:08 +0200 MIME-Version: 1.0 Message-Id: <20260928-prep-kh-vstor-138640-vhost-blk-vq-mutex-v1-1-48ae0775bc8a@virtuozzo.com> X-B4-Tracking: v=1; b=H4sIANOGumoC/yWNQQ7CIBBFr9LM2kmAEoJexbigdRSslpahpLHp3 UVdvp/89zZgSoEYTs0GiUrgEMcK8tBA7914JwzXyqCEMuKoLE6JJhw8Fs4xoWyt0QKLj5yxew5 YZnwtmVa02kmnjWiVI6i2+ruF9Vc6Q3lLAZf/ykv3oD5/I7DvH4JK/kORAAAA X-Change-ID: 20260928-prep-kh-vstor-138640-vhost-blk-vq-mutex-84a1a46032ae To: Andrey Zhadchenko X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3386; i=khorenko@virtuozzo.com; h=from:subject:message-id; bh=QSERk4neFQrJ7raSYcMQdCxcmYeISf8SoE3wBchR2ao=; b=owEBbQKS/ZANAwAKAVGWCkf5YVwqAcsmYgBquobWakxu7SwlS5OUtFFwZWGZKV4BhZ336bzNj 2h8UyM1vYqJAjMEAAEKAB0WIQRWD23IPcXT0GO9CCxRlgpH+WFcKgUCarqG1gAKCRBRlgpH+WFc KkdFEACNUZqio13xEZZQB7K0J7ECWfvZ06iRVCWs5T78G5gQa6BzZVs9DZcIZZhjwrxCtIy5gGi xIzGysqCaazhnTPsCl5m1Ict1RjjhI/lyolS2pRHOvIuxXOKt+Ou/8/Z0ZcXMeQ7TMCirNFchvK tGPtwiCzQm8pnpDRLjc2pzCN2LwsBY/l5aTeEw2K+D5lvD7QlLd2LgU3GbJNF8Iu8MqC4niN21c JeVwoiGKTZIrqK3oHCaDHa7tE4E1XGPvFDLKgnYUzeacdmzTsiAU+7GM7KMfQTbljmb/LqC4JE1 82sjpSJlBzc+FeIUB4yuJ1izJkuNBWkqVtEWN74A2z1BhkT/JvK7oMYCzy02zj/pZct3I3Ciii3 qL+UdFKkgSb4pN8abURpZUj401YOGuYanw/6ajqBSaYvdgryXt5iwASQUzI/cZrEIrkm9vrAjhv 3WL8BBgjQ6UV/dyh30d6j0q8v2dPlHRhEZ/kBR/HH9TGVWH88XVr1cMwwJTtnKGIMExSEWFAkUa 2zouA2ycVeEQDzAbt9DjENhGH1MLGBJaj6DPqtVGfQqH/SqY6tzkF+gxZfCBS4/ei3RO13h82tJ i3P692INuk3gqWhhqyycImFp8RKm642ImmTubAeReHcr8TNzmSptmm9+4aTD0GZBzKyF3oAOmxe mSd0Kdmcl+eEsjg== X-Developer-Key: i=khorenko@virtuozzo.com; a=openpgp; fpr=560F6DC83DC5D3D063BD082C51960A47F9615C2A X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH vz10] drivers/vhost/blk: take vq->mutex in the kick handlers X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org vhost.h documents vhost_vq_set_backend()/vhost_vq_get_backend() as "need to call with vq->mutex acquired": vq->private_data is a plain field with no barriers. * vhost-net, vsock and scsi all take vq->mutex in their kick handlers * vhost-blk reads the backend and works with the ring without it On a weakly ordered CPU (arm64) the two stores can become visible in the opposite order: CPU0: VHOST_BLK_SET_BACKEND CPU1: vhost worker ----------------------------------- ------------------------------- blk_vq->req = kvmalloc_array(...); mutex_lock(&vq->mutex); vhost_vq_set_backend(vq, backend); mutex_unlock(&vq->mutex); backend store becomes visible f = vhost_vq_get_backend(vq); /* sees the new backend */ head = vhost_get_vq_desc(...); req = &blk_vq->req[head]; /* sees the old req: NULL on the first SET_BACKEND, a freed pointer after a -1/fd cycle - a NULL-offset oops or a use-after-free */ req store becomes visible - too late x86-64 TSO forbids both the store-store reordering on CPU0 and the load-load reordering on CPU1, which is the only reason the current code works there. Fixes: d8722ff88c5d ("drivers/vhost: vhost-blk accelerator for virtio-blk guests") https://virtuozzo.atlassian.net/browse/VSTOR-138640 Feature: vhost-blk: in-kernel accelerator for virtio-blk guests Signed-off-by: Konstantin Khorenko --- drivers/vhost/blk.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c index fbdd04f5a7e28..b170439a1806d 100644 --- a/drivers/vhost/blk.c +++ b/drivers/vhost/blk.c @@ -530,9 +530,11 @@ static void vhost_blk_handle_guest_kick(struct vhost_work *work) blk = container_of(vq->dev, struct vhost_blk, dev); blk_vq = container_of(vq, struct vhost_blk_vq, vq); + mutex_lock(&vq->mutex); + f = vhost_vq_get_backend(vq); if (!f) - return; + goto out; vhost_disable_notify(&blk->dev, vq); for (;;) { @@ -580,6 +582,8 @@ static void vhost_blk_handle_guest_kick(struct vhost_work *work) break; } } +out: + mutex_unlock(&vq->mutex); } static void vhost_blk_handle_host_kick(struct vhost_work *work) @@ -594,6 +598,8 @@ static void vhost_blk_handle_host_kick(struct vhost_work *work) blk_vq = container_of(work, struct vhost_blk_vq, work); vq = &blk_vq->vq; + + mutex_lock(&vq->mutex); llnode = llist_del_all(&blk_vq->llhead); added = false; while (llnode) { @@ -627,6 +633,7 @@ static void vhost_blk_handle_host_kick(struct vhost_work *work) if (likely(added)) vhost_signal(&blk->dev, vq); + mutex_unlock(&vq->mutex); } /* It is forbidden to call more than one vhost_blk_flush() simultaneously */ --- base-commit: 0679f0d70523972eec3a0643565521d93e26eb9c change-id: 20260928-prep-kh-vstor-138640-vhost-blk-vq-mutex-84a1a46032ae Best regards, -- Konstantin Khorenko _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel