Re: [PATCH v2] vhost-scsi: serialize completion notification with callfd updates
Stefan Hajnoczi <[email protected]>
| Newsgroups | org.kernel.vger.netdev,dev.linux.lists.virtualization,org.kernel.vger.kvm,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <20260812184845.GA259475@fedora> |
On Thu, Aug 06, 2026 at 02:51:43PM +0800, Jia Jia wrote:
> vhost_scsi_complete_cmd_work() drops the virtqueue mutex before calling
> vhost_signal(). VHOST_SET_VRING_CALL replaces call_ctx.ctx and releases the
> old eventfd_ctx while holding the same mutex. vhost_signal() reads the call
> context before and after vhost_notify(), so a concurrent callfd update can
> make it signal a freed context or NULL.
>
> KASAN reported the use through:
>
> eventfd_signal_mask
> vhost_signal
> vhost_scsi_complete_cmd_work
>
> The context was released through:
>
> eventfd_ctx_put
> vhost_vring_ioctl
> vhost_scsi_ioctl
>
> Keep the mutex held through vhost_signal() so completion notification and
> callfd updates are serialized.
>
> Fixes: 057cbf49a1f0 ("tcm_vhost: Initial merge for vhost level target fabric driver")
> Link: https://lore.kernel.org/r/[email protected]
> Signed-off-by: Jia Jia <[email protected]>
> ---
> Changes since RFC:
> - Send as a non-RFC v2.
> - Add Fixes and Link tags.
>
> drivers/vhost/scsi.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
Reviewed-by: Stefan Hajnoczi <[email protected]>
signature.asc
(application/pgp-signature, 488 B)
-----BEGIN PGP SIGNATURE----- iQEzBAEBCgAdFiEEhpWov9P5fNqsNXdanKSrs4Grc8gFAmp8wA0ACgkQnKSrs4Gr c8gS9wf7B5UusKdqG9SmB9caKbFt9+tVhCHTHHu5YqHL1TrUkssemsA+b/2grmt5 No+sYQ/zGeyoYPvFLrNQm+2r49/Pz+kq84KbovRe4BzRRtISWicqPDALsChD+wsU RxCYfkfB3gelfgBTZrWzr+hycIPWnDv/36OBE+jwMTf6ZkWR7riu1enH0NS76Qow 5omHltl0cMxd1egdTOa6ZxrTldw3rv1Cdey31sbaYmqiBZMnSb2AHp1lCTqfSq7q D9+ftvlRHr0I8xbWQsrEbChZK48PQtTCJr5KFgnNCZ1wQM/Fo+L0Lt7ppeRPlih1 PcZ1owKQzZ6OeedAyzQkHPq5jEGB8w== =7yPr -----END PGP SIGNATURE-----