[Devel] [PATCH RHEL10 COMMIT] drivers/vhost/blk: harden get_id command

[Konstantin Khorenko]

The commit is pushed to "branch-rh10-6.12.0-211.39.1.16.x.vz10-ovz" and will appear at git at bitbucket.org:openvz/vzkernel.git
after rh10-6.12.0-211.39.1.16.9.vz10
------>
commit 052898980e0330e6cc936ebf0f937d2431cdee61
Author: Andrey Zhadchenko <andrey.zhadchenko at virtuozzo.com>
Date:   Tue Aug 25 15:51:48 2026 +0300

    drivers/vhost/blk: harden get_id command
    
    A defensive patch.
    QEMU is fine with reporting empty serial and including null
    terminator. So we will do the same.
    
    https://virtuozzo.atlassian.net/browse/VSTOR-138640
    Feature: vhost-blk: in-kernel accelerator for virtio-blk guests
    Signed-off-by: Andrey Zhadchenko <andrey.zhadchenko at virtuozzo.com>
    Reviewed-by: Vasileios Almpanis <vasileios.almpanis at virtuozzo.com>
    Reviewed-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
 drivers/vhost/blk.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c
index dac03566bfca5..edd3e75873ff5 100644
--- a/drivers/vhost/blk.c
+++ b/drivers/vhost/blk.c
@@ -105,8 +105,6 @@ struct vhost_blk {
 	pid_t owner_pid;
 };
 
-static int gen;
-
 static int move_iovec(struct iovec *from, struct iovec *to,
 		      size_t len, int iov_count_from, int iov_count_to)
 {
@@ -491,7 +489,9 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq,
 		ret = vhost_blk_req_submit(req);
 		break;
 	case VIRTIO_BLK_T_GET_ID:
-		len = strnlen(blk->serial, VIRTIO_BLK_ID_BYTES);
+		len = min_t(size_t,
+			    strnlen(blk->serial, VIRTIO_BLK_ID_BYTES) + 1,
+			    min_t(size_t, req->len, VIRTIO_BLK_ID_BYTES));
 		iov_iter_init(&iter, ITER_DEST, req->iov, req->iov_nr, req->len);
 		ret = copy_to_iter(blk->serial, len, &iter);
 		status = ret != len ? VIRTIO_BLK_S_IOERR : VIRTIO_BLK_S_OK;
@@ -688,7 +688,6 @@ static int vhost_blk_open(struct inode *inode, struct file *file)
 	}
 
 	memset(blk->serial, 0, sizeof(blk->serial));
-	snprintf(blk->serial, VIRTIO_BLK_ID_BYTES, "vhost-blk%d", gen++);
 
 	atomic_set(&blk->req_inflight[0], 0);
 	atomic_set(&blk->req_inflight[1], 0);