[Devel] [PATCH hci-8.1] drivers/vhost/blk: fail guest writes to a read-only backend

[Andrey Zhadchenko]

Reviewed-by: Andrey Zhadchenko <andrey.zhadchenko at virtuozzo.com>

On 10/28/26 10:35, Alexander Ivanov wrote:
> When a disk is attached read-only, QEMU opens the backing block device
> O_RDONLY and advertises VIRTIO_BLK_F_RO. vhost_blk_set_backend() checks
> only that the fd is a block device, and requests are submitted as bios
> straight to the bdev, so a guest that ignores VIRTIO_BLK_F_RO and sends
> VIRTIO_BLK_T_OUT gets VIRTIO_BLK_S_OK and modifies the disk.
> 
> Complete VIRTIO_BLK_T_OUT with VIRTIO_BLK_S_IOERR when the backend file
> lacks FMODE_WRITE or the bdev itself is read-only, as the userspace
> virtio-blk device does. The bdev is checked per request since it can be
> switched read-only at runtime. Flush stays allowed: it does not modify
> data.
> 
> Fixes: d8722ff88c5d ("drivers/vhost: vhost-blk accelerator for virtio-blk guests")
> https://virtuozzo.atlassian.net/browse/VSTOR-152127
> Feature: vhost-blk: in-kernel accelerator for virtio-blk guests
> 
> Signed-off-by: Alexander Ivanov <alexander.ivanov at virtuozzo.com>
> ---
>   drivers/vhost/blk.c | 15 +++++++++++++++
>   1 file changed, 15 insertions(+)
> 
> diff --git a/drivers/vhost/blk.c b/drivers/vhost/blk.c
> index b170439a1806..11ded3214c45 100644
> --- a/drivers/vhost/blk.c
> +++ b/drivers/vhost/blk.c
> @@ -443,6 +443,12 @@ static int vhost_blk_req_submit(struct vhost_blk_req *req)
>   	return ret;
>   }
>   
> +static bool vhost_blk_backend_ro(struct file *f)
> +{
> +	return !(f->f_mode & FMODE_WRITE) ||
> +	       bdev_read_only(I_BDEV(f->f_mapping->host));
> +}
> +
>   static int vhost_blk_req_handle(struct vhost_virtqueue *vq,
>   				struct virtio_blk_outhdr *hdr,
>   				u16 head, u16 out, u16 in)
> @@ -480,6 +486,15 @@ static int vhost_blk_req_handle(struct vhost_virtqueue *vq,
>   
>   	switch (hdr->type) {
>   	case VIRTIO_BLK_T_OUT:
> +		if (vhost_blk_backend_ro(vhost_vq_get_backend(vq))) {
> +			status = VIRTIO_BLK_S_IOERR;
> +			ret = vhost_blk_set_status(req, status);
> +			if (ret)
> +				break;
> +			vhost_add_used_and_signal(&blk->dev, vq, head,
> +						  sizeof(status));
> +			break;
> +		}
>   		req->bi_opf = REQ_OP_WRITE;
>   		ret = vhost_blk_req_submit(req);
>   		break;