[Devel] [PATCH hci-8.1] drivers/vhost/blk: reject a head that is still in flight

[Alexander Ivanov]

On 10/29/26 13:05, Konstantin Khorenko wrote:
>
> --
> Best regards,
>
> Konstantin Khorenko,
> Virtuozzo Linux Kernel Team
>
> On 10/28/26 09:14, Alexander Ivanov wrote:
>    > The second
>    > submission also overwrites bio[], bio_nr and the iovecs of bios that
>    > are still in flight.
>
>    It also frees the bounce buffer and bio[] of the first submission under
>    bios that are still in flight, so this is a use-after-free, not only a
>    counter leak. Worth a sentence here.
>
>    > +     if (unlikely(req->inflight))
>    > +             return -EBUSY;
>
>    Please add a vhostblk_vq_err() here naming the head. Now the host log
>    only shows the caller's generic "Failed to process guest request" with
>    -16.
Fixed in the next version.
>
>    A separate ticket, not for this patch: vhost_blk_req_done() ignores a
>    failed vhost_vq_work_queue(). After vhost_worker_killed() (QEMU
>    SIGKILLed with bios in flight) vq->worker is NULL, the completion is
>    lost, forget_request() never runs and release hangs in
>    vhost_blk_flush() the same way.
>
>    Please file a ticket an post it here for the reference.
>
>    Reviewed-by: Konstantin Khorenko <khorenko at virtuozzo.com>
https://virtuozzo.atlassian.net/browse/VSTOR-152380
>
> --
> Best regards,
>
> Konstantin Khorenko,
> Virtuozzo Linux Kernel Team