[Devel] [PATCH hci-8.1] drivers/vhost/blk: reject a head that is still in flight

[Konstantin Khorenko]

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team

On 10/28/26 09:14, Alexander Ivanov wrote:
  > The second
  > submission also overwrites bio[], bio_nr and the iovecs of bios that
  > are still in flight.

  It also frees the bounce buffer and bio[] of the first submission under
  bios that are still in flight, so this is a use-after-free, not only a
  counter leak. Worth a sentence here.

  > +     if (unlikely(req->inflight))
  > +             return -EBUSY;

  Please add a vhostblk_vq_err() here naming the head. Now the host log
  only shows the caller's generic "Failed to process guest request" with
  -16.


  A separate ticket, not for this patch: vhost_blk_req_done() ignores a
  failed vhost_vq_work_queue(). After vhost_worker_killed() (QEMU
  SIGKILLed with bios in flight) vq->worker is NULL, the completion is
  lost, forget_request() never runs and release hangs in
  vhost_blk_flush() the same way.

  Please file a ticket an post it here for the reference.

  Reviewed-by: Konstantin Khorenko <khorenko at virtuozzo.com>

--
Best regards,

Konstantin Khorenko,
Virtuozzo Linux Kernel Team