Re: [PATCH v2] vhost-scsi: flush backend after device ioctls

On Fri, Jul 24, 2026 at 02:09:19PM +0800, Jia Jia wrote:
> vhost-scsi translates guest response descriptors into userspace iovecs
> when commands are submitted.  Target-core completes those commands
> asynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while
> an in-flight command still retains response iovecs translated through the
> old table.
> 
> If the old mapping is reused after VHOST_SET_MEM_TABLE returns, command
> completion can write the response to an unrelated userspace object.
> 
> Flush the vhost-scsi backend after vhost_dev_ioctl() handles a device
> ioctl.  This waits for in-flight commands that can still use the old
> response iovecs before the ioctl returns.
> 
> Changes in v2:
> - Shorten the changelog and remove investigation details.

fyi changelog should go after ---


can you pls answer mike's question on v1?
Also pls do not post v2 as response to v1

> Signed-off-by: Jia Jia <[email protected]>
> ---
>  drivers/vhost/scsi.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
> index 9a1253b9d8c5..c3e8f1a0b2d4 100644
> --- a/drivers/vhost/scsi.c
> +++ b/drivers/vhost/scsi.c
> @@ -2424,10 +2424,11 @@ vhost_scsi_ioctl(struct file *f, unsigned int ioctl, unsigned long arg)
>  	default:
>  		mutex_lock(&vs->dev.mutex);
>  		r = vhost_dev_ioctl(&vs->dev, ioctl, argp);
> -		/* TODO: flush backend after dev ioctl. */
>  		if (r == -ENOIOCTLCMD)
>  			r = vhost_vring_ioctl(&vs->dev, ioctl, argp);
> +		else
> +			vhost_scsi_flush(vs);
>  		mutex_unlock(&vs->dev.mutex);
>  		return r;
>  	}
>  }
> -- 
> 2.43.0