From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.openvz.org (mail.openvz.org [69.168.225.77]) by lore.virtuozzo.com (Postfix) with ESMTPS id 1A0DD8045D for ; Thu, 29 Oct 2026 13:00:54 +0000 (UTC) Received: from mail.openvz.org (localhost [127.0.0.1]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69TCxdYZ032667; Thu, 29 Oct 2026 15:59:40 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69TCxdYZ032667 Authentication-Results: mail.openvz.org; dkim=fail reason="signature verification failed" (2048-bit key) header.d=virtuozzo.com header.i=@virtuozzo.com header.b="eNnwQSgz" Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by mail.openvz.org (8.14.4/8.14.4) with ESMTP id 69TCxROn032636 (version=TLSv1/SSLv3 cipher=AES128-GCM-SHA256 bits=128 verify=FAIL) for ; Thu, 29 Oct 2026 15:59:27 +0300 DKIM-Filter: OpenDKIM Filter v2.11.0 mail.openvz.org 69TCxROn032636 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-48e1d839ddaso1413483f8f.3 for ; Thu, 29 Oct 2026 05:59:27 -0700 (PDT) X-Forwarded-Encrypted: i=2; AKwUvBwVjHjHZvB8wiem/JNcvIC29NnCUmAb3qfb652fdrbgkiFxPe612reNt2kIwzf7X/2k+IYwEw==@openvz.org X-Gm-Message-State: AFq9FYJmu+qzf7QWsZzPcdb7y3XBAbRyLtougmQo4TYw7z9F2JnXrogb T3g+nOKftj8cIvv+lmFicPmaqcD938d/tnoePQBivgmKIz2gB0b2eAEn3evYZjCgTEoF0nahdxS 10fANU+WrjsJivBuTLDY/sl5wK20yh3dJZ7jHd+h5+MwuSkWoFwoauA== X-Gm-Gg: AYBFou1pCKn3LgFyLK3HImj61p16hiz6HrxpncSER4CPQVokFpw188zS6B7m+0vZvZE Gm4WhE/eE8Bl0xT/qfCGDFebhYFdJn9ul7CKXTajRHT52w6Nn0VVFgi9SwmRQkgRIisit3ZvYal AvI8PkV31ARw06F9kuXuriOG7GzgqebQkNjYbvYSryBkj4DzCWt2Ns9aojgfX1lsznHl3uCeGxq zNKq72JCnsaEgLSFUctsPOOvpC+wmOvd5REMeM5pzIfk+O9l5TP4HMV+EaO6ZZ+aigxBR+imV+/ qX5shaFbpVdAKb0pvO01lYiyebT7etdcWYUSDhgF+t4Qoc0YxQ4Kubdfts/fROijK6cGIUFjUYR QRtosK451e2qW7cNy3sg44m6b66E= X-Received: by 2002:adf:e188:0:b0:48c:7306:18e9 with SMTP id ffacd0b85a97d-48e5d5ad68amr12990702f8f.43.1793278767345; Thu, 29 Oct 2026 05:59:27 -0700 (PDT) X-Received: by 2002:adf:e188:0:b0:48c:7306:18e9 with SMTP id ffacd0b85a97d-48e5d5ad68amr12990661f8f.43.1793278766803; Thu, 29 Oct 2026 05:59:26 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1793278766; cv=none; d=google.com; s=arc-20260327; b=jeffEuNyWjwYjekvB+jGMPGpKWAw1z8VP3Y0MxmwfKeRe85ky0dttxJfmCXK6oQdBo mLQCAO/bVEXgGiCHig3u4pu3c0ImiF6px4cmjqdTW7EKR+55Y3qx0NRsPh0IY03zNQva TJJ4nvjUnPnUkn/5UxRsO/ljkTNT9uRhyJ6r4KKi4xrYC8QeOgDDOhZzTZHFaMD9b/T6 epnFD5kOGsJGjvRZeLnsRFShy8Uzy/8/CrArFxa7obdPvoHowkHzjL1xCxeWEg/KHFMl RckS3D0Xp+m5E4K9Zv5pX9mIKeP8AHyBdkm/PcblvRutpr5sutjNhloLw9YJui+ZG4nu mc8w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20260327; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=8YON1xks78Fxg43NkSYCiMyjP+6pAeAN7Mh1GkVH64M=; fh=CMILZ+goaghq6B4UpCDhf0EQp6kYD0LAlmOkUiVCOvs=; b=JoOBAuqrgxCW8UyA485vXD3pt9LMDaReM30hsJWkPLzwpX6T2nYBE1PbHbmlmDaKfy HpMjmp6Wg9FBH0dWjo3gA5obVLDPPkEAJhNthxptFVkKlfzSydOHou1D4UVwDkWl2MWc EDF+0BiBjBRyecMc16ET0dj2ulfk70Fqo81SzuFPjX+hQV6CAVuR6bt/wCKtugheap4+ 7XrWfN2EY2w12VO542AelvTlXrUS5ETL1ohMEqsSvvErwh26BokC4Nl7zw8VHSDtYhOO i5C49XmwK4gJYeJZKlLRT0ttMxSrGrx7HyLesLkC3Mrla5jKr63WaGWjo8GXV7phMPkM e46g==; dara=google.com ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=eNnwQSgz; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com Received: from relay.virtuozzo.com (relay.virtuozzo.com. [130.117.225.111]) by mx.google.com with ESMTPS id ffacd0b85a97d-48e3ed28946si31592305f8f.460.2026.10.29.05.59.26 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 29 Oct 2026 05:59:26 -0700 (PDT) Received-SPF: pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) client-ip=130.117.225.111; Authentication-Results: mx.google.com; dkim=pass header.i=@virtuozzo.com header.s=relay header.b=eNnwQSgz; spf=pass (google.com: domain of alexander.ivanov@virtuozzo.com designates 130.117.225.111 as permitted sender) smtp.mailfrom=alexander.ivanov@virtuozzo.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=virtuozzo.com DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=virtuozzo.com; s=relay; h=MIME-Version:Message-ID:Date:Subject:From: Content-Type; bh=8YON1xks78Fxg43NkSYCiMyjP+6pAeAN7Mh1GkVH64M=; b=eNnwQSgzBbcc cN3jFm4R2gPyfUcahk3YsX8liF4Dc9Km1hUAH0WZ1Mb0JQLxugs2VZBqrrJWpj2kTtfnDYPDM27P3 y8rwRswG4CCpOgAYrzOEYY9b2iMC7s8CjduBBM0n2rqkdHJvBqv/iOq0wlkcY6I7n+/qa1e8b/U84 Nixi3Ycv6dnZ0fd59I1PFReLbJBCmaLWBhMdYZU5frP8Vf1i/UF5vLgfhIfJlQSJFnv/TxaSmUJ14 UBK+zucegmgdq9kLBlunWz1UEibyP+rGirAPzTqLwaXWCnGHQ8qboal2opfQtnqW2UlvOh4kXArJn 9UHwydJ0xX8Zdx9kUnAbnw==; Received: from ch-vpn.virtuozzo.com ([130.117.225.6] helo=sky) by relay.virtuozzo.com with esmtps (TLS1.3) tls TLS_AES_256_GCM_SHA384 (Exim 4.96) (envelope-from ) id 1xMPfG-005INM-2e; Thu, 29 Oct 2026 13:59:24 +0100 From: Alexander Ivanov To: andrey.zhadchenko@virtuozzo.com Date: Thu, 29 Oct 2026 13:59:23 +0100 Message-ID: <20261029125923.3352735-4-alexander.ivanov@virtuozzo.com> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20261029125923.3352735-1-alexander.ivanov@virtuozzo.com> References: <20261029125923.3352735-1-alexander.ivanov@virtuozzo.com> MIME-Version: 1.0 X-OZ-Fwd: true Cc: devel@openvz.org Subject: [Devel] [PATCH hci-8.1 v2 3/3] drivers/vhost/blk: take req->len from one side of the descriptor chain X-BeenThere: devel@openvz.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: OpenVZ development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: devel-bounces@openvz.org Errors-To: devel-bounces@openvz.org req->len covered the whole descriptor chain, so both readable and writable data buffers became the payload. A read wrote disk data into device-readable buffers and reported them as used, a write sent the guest's writable buffers to disk. Take write data only from the readable part and the payload of other requests only from the writable part, as QEMU does. Read the status byte from the end of the writable part. Complete a read or write with VIRTIO_BLK_S_IOERR if its payload is empty, above ALIGN_DOWN(INT_MAX, SECTOR_SIZE) or, for a write, not a multiple of SECTOR_SIZE. An empty payload used to fail in bio setup and an unaligned write hit a WARN_ONCE() reachable from the guest. In both cases the kick handler broke out with the descriptor consumed and notifications disabled, so the virtqueue stalled. Drop the WARN_ONCE(). The size bound is new for writes: the readable side had no limit and a write of any size was submitted. Reads above INT_MAX still get -EINVAL from the in_len check, the bound only covers the range below it. https://virtuozzo.atlassian.net/browse/VSTOR-142755 Fixes: 1629db092dd7 ("drivers/vhost: vhost-blk accelerator for virtio-blk guests") Fixes: 02ce37f62707 ("vhost-blk: add bounce-buffer for non-aligned requests") Feature: vhost-blk: in-kernel accelerator for virtio-blk guests Signed-off-by: Alexander Ivanov --- drivers/vhost/blk.c | 43 ++++++++++++++++++++++++++++++------------- 1 file changed, 30 insertions(+), 13 deletions(-) diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c index 94317a5f2cb6..3448910f9046 100644 --- a/drivers/vhost/blk.c +++ b/drivers/vhost/blk.c @@ -277,12 +277,6 @@ static int vhost_blk_bio_make(struct vhost_blk_req *req, if (unlikely(req->bi_opf & REQ_PREFLUSH)) return vhost_blk_bio_make_simple(req, bdev); - if (req->bi_opf == REQ_OP_WRITE && !IS_ALIGNED(req->len, SECTOR_SIZE)) { - WARN_ONCE(1, "vhost-blk: write requests with unaligned len" - " are not supported, len = %zu", req->len); - return -EINVAL; - } - /* * Requests with unaligned io vectors are not supported by underlined * block device, let's use an aligned intermediary "bounce buffer" to @@ -450,10 +444,10 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq, struct vhost_blk *blk = container_of(vq->dev, struct vhost_blk, dev); struct vhost_blk_vq *blk_vq = container_of(vq, struct vhost_blk_vq, vq); struct vhost_blk_req *req; - u16 total_iov_nr = out + in; + struct iovec *data_iov, *st; struct iov_iter iter; size_t in_len; - int ret, len; + int ret, len, data_nr; u32 type; u8 status; @@ -470,14 +464,37 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq, if (in_len < sizeof(status) || in_len > INT_MAX) return -EINVAL; - req->len = iov_length(vq->iov, total_iov_nr) - sizeof(status); - req->iov_nr = move_iovec(vq->iov, req->iov, req->len, total_iov_nr, + /* The status is the last byte of the device-writable part */ + for (st = vq->iov + out + in - 1; !st->iov_len; st--) + ; + st->iov_len -= sizeof(status); + req->status[0].iov_base = st->iov_base + st->iov_len; + req->status[0].iov_len = sizeof(status); + + if (type == VIRTIO_BLK_T_OUT) { + data_iov = vq->iov; + data_nr = out; + } else { + data_iov = vq->iov + out; + data_nr = in; + } + + req->len = iov_length(data_iov, data_nr); + + if ((type == VIRTIO_BLK_T_IN || type == VIRTIO_BLK_T_OUT) && + (!req->len || req->len > ALIGN_DOWN(INT_MAX, SECTOR_SIZE) || + (type == VIRTIO_BLK_T_OUT && !IS_ALIGNED(req->len, SECTOR_SIZE)))) { + ret = vhost_blk_set_status(req, VIRTIO_BLK_S_IOERR); + if (!ret) + vhost_add_used_and_signal(&blk->dev, vq, head, sizeof(status)); + return ret; + } + + req->iov_nr = move_iovec(data_iov, req->iov, req->len, data_nr, ARRAY_SIZE(blk_vq->iov)); req->bb = NULL; - ret = move_iovec(vq->iov, req->status, sizeof(status), total_iov_nr, - ARRAY_SIZE(req->status)); - if (ret < 0 || req->iov_nr < 0) + if (req->iov_nr < 0) return -EINVAL; switch (type) { -- 2.53.0 _______________________________________________ Devel mailing list Devel@openvz.org https://lists.openvz.org/mailman/listinfo/devel