From nobody Fri Jul 24 22:17:21 2026 Received: from mail-pg1-f169.google.com (mail-pg1-f169.google.com [209.85.215.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F0F5127FD49 for ; Fri, 24 Jul 2026 03:44:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.169 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784864648; cv=none; b=sxbDs7vbE6L3gDcbRhG0rkTwBc//ABnZZPv/gP7fA/k/HE+52Wz9PvqZKEpoYfEAlN4R4x5Ne6LvJYah/8tCSsttXkMhfrZphfo48i7t4HfXhY2sbJdF3oZ4yyAFqcQABrLiR2mgI22DPI45rJV2aMRkFohHzsK0zudUiPdiYv8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784864648; c=relaxed/simple; bh=xJlJwMlZqQOc1MeDeLM7Ds5ojKq8KazDXodYNMxiQLg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=fRfcFVPktgu8nEtv05f+TgUZ/R8KLy1xk3yye/aAKEDNbcBI4+LkLqj5jDZFGT1kMtJ6DavaG1dpwKMLxDB5xZPue6JTNdS57gNxv3YVj3+/ejqfViIvc33bJ76zBl1+bf6JZlwC5wMoz4pIouCKfyWAjTAxXOGsugd1W77Wpyg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IiB1rB0L; arc=none smtp.client-ip=209.85.215.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IiB1rB0L" Received: by mail-pg1-f169.google.com with SMTP id 41be03b00d2f7-c9e30214d8fso1038129a12.3 for ; Thu, 23 Jul 2026 20:44:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784864646; x=1785469446; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=IjSrN5U+fixNHZuhLquWtTETqgon0l+Qo4BnxexgPeo=; b=IiB1rB0LufhLUngsJGMOpwuH307ifQeo/qxh1hsxJlkaYmqenZAzl3YVpWIhOlF7F/ 0Ja2v1IUrDkvb+yO3WHYwb0Lv7zuvi06c7BzVhvwThBVHTb7/qGTy87bANckjpUxaHLf MZ8MqUWx9vuIz/1n+GSyKaUZ0RdMm9VDCvDspwwCv4ptwHuCS+2l20VefpjnAIU34wkn yZWM7SZJOAtuGNSgNrgBk7Gu0jXwBaFGw0fD7RqbFy42DIWBApNnCbMUBvUk0FVTAxMp rwwQPVXUzk3Z0htxqf998m/5lVwKV6emnOdcjl9vu+lcyTde2wDYOXzfRHMNLN+dkVLh cafw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784864646; x=1785469446; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=IjSrN5U+fixNHZuhLquWtTETqgon0l+Qo4BnxexgPeo=; b=CcoM6zYnhDfmi9sX2kaY5YqT6xGNwEmlCofg+y8UFv+8Jru73exfpBYmvt0bRWPNwk 9ETHHHDkaS8mux6wcUTDImCrGkd2OddOxJFlLrO3WjitNoXcCqIEcjZ4xIWuIOjvtr9F z0YQ1o/Vybe6JH8Ki4j7QIxROAnFD3VVmvCirTJQWglR3TC9cTpa0uC+4Tny/bZ2kmx9 LU5qD9YzxgP7EBDNz90vKHSipeTotOeS4FDkx0Jmt6dIs33yyHhNpaOO219f+LfoezbH l9L642e2wjDBFeRgAYqN52euz3o/VbjNqmgqXmhQYgCBOLqtrOS41siqb9Jt1dt4pkWy AMIg== X-Forwarded-Encrypted: i=1; AHgh+RrFmg7Ccoi0hQUwIHjVohB6p3Yn8mnHQ0H8h6Ck5TzQLFvIB//kd2QPQ68svyn/QZ5NrMAvN3CylFv84Lk=@vger.kernel.org X-Gm-Message-State: AOJu0YxcCtVuwABZdu5Ok4nOZDmdOoWAnXQtWkIXAenXvjsVfdwhYpTd r64sm6cIlfdDMf+D43IRiHvcdJHOKFxujGY6iPSFNE8gpEfN6T6KUc3R X-Gm-Gg: AR+sD11ofNiAqjOfnm9VPGQ9lekZLj6c0SUPj2jF80HAquiApwynR3kqjCLJwXrYzmp SYsos9DncAL06K8PS8wZJpKvmRNKLY9GYivbn2fJq2llGDb+VMGpyVs/1cNhXEs0GG6AD1gRHFi 8fByATc8xlu3JN0uRZPzbd7cZpcL21/61RUIGOMno5Iijz9hvs6zZpXJpAeLBNXMR3GWTrP89Wh mT8i1XwNioVQA+Ja9++9MzXn4YAwo0CEyQEiQS4fL+RKcJFq258KB9J1VZGgObzcx8r/IQE50hG t1CIMtifiNWBM9ArjA0K2DuCz42YLRxtWnQxIMGMXzBSYYECnyZnHetBzOTvQQUOT+q3Cnnr9e/ g2dz8JUZVy2uCIQ49/tya0Hb3X4uXScdQ2JJ4lL/SGJCZHi17WKv+w0Zspd796iHteXwrO2//9e a8gkSU X-Received: by 2002:a05:6a21:1f8a:b0:3b1:cce5:9140 with SMTP id adf61e73a8af0-3c44b051802mr6868812637.33.1784864645799; Thu, 23 Jul 2026 20:44:05 -0700 (PDT) Received: from jia ([188.253.12.32]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-3147dc193f8sm41749064eec.1.2026.07.23.20.44.02 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 23 Jul 2026 20:44:05 -0700 (PDT) From: Jia Jia To: mst@redhat.com Cc: jasowangio@gmail.com, michael.christie@oracle.com, pbonzini@redhat.com, stefanha@gmail.com, stefanha@redhat.com, eperezma@redhat.com, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org Subject: [PATCH v2] vhost-scsi: reject feature changes after endpoint Date: Fri, 24 Jul 2026 11:43:55 +0800 Message-Id: <20260724034355.1568036-1-physicalmtea@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" vhost_scsi_setup_vq_cmds() runs from VHOST_SCSI_SET_ENDPOINT and allocates each command's protection scatterlist array (prot_sgl) according to the acknowledged VIRTIO_SCSI_F_T10_PI bit. The command pools are not rebuilt when VHOST_SET_FEATURES changes that bit later. Although virtio feature bits must not change after feature negotiation, vhost_scsi_set_features() currently accepts such a request after the endpoint is active and updates acked_features. Enabling T10-PI after endpoint setup therefore leaves prot_sgl NULL while the I/O path follows the new feature bit. For a 129-page protection payload, vhost_scsi_mapal() passes the missing first chunk to sg_alloc_table_chained(): sg_alloc_table_chained(table, 129, first_chunk=3DNULL, nents_first_chunk=3Dinline_sg_cnt) sg_pool_index() then hits: BUG_ON(nents > SG_CHUNK_SIZE); /* 129 > 128 */ The kernel reported the following call trace and register state: Call Trace: ? __sg_alloc_table+0x1d8/0x250 ? __pfx_vhost_run_work_list+0x10/0x10 [vhost] sg_alloc_table_chained+0x59/0xf0 ? __pfx_sg_pool_alloc+0x10/0x10 ? vhost_scsi_calc_sgls.constprop.0+0x43/0x60 [vhost_scsi] vhost_scsi_handle_vq+0xf02/0x1700 [vhost_scsi] ? __pfx_vhost_scsi_handle_vq+0x10/0x10 [vhost_scsi] vhost_scsi_handle_kick+0x37/0x50 [vhost_scsi] vhost_run_work_list+0x8e/0xd0 [vhost] vhost_task_fn+0xe1/0x210 ret_from_fork+0x348/0x540 RIP: 0010:0x4 CR2 =3D 0x4 RSP: 0018:ffffc90000dbf940 EFLAGS: 00010202 RAX: ffffffff82396810 RBX: ffff88811dc28b80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000820 RDI: 0000000000000081 VHOST_F_LOG_ALL is a vhost-specific runtime feature and remains the only exception. Reject changes to any feature other than VHOST_F_LOG_ALL while the endpoint is active. This preserves the existing runtime log toggle while preventing feature-dependent command resources and data-path state from becoming inconsistent. Userspace must clear the endpoint before changing any other negotiated feature and set the endpoint up again afterward. Fixes: bf2d650391be ("vhost-scsi: Allocate T10 PI structs only when enabled= ") Signed-off-by: Jia Jia --- Changes in v2: - Reject changes to every feature except VHOST_F_LOG_ALL after endpoint setup, following review feedback. - Keep the existing runtime VHOST_F_LOG_ALL cleanup path. drivers/vhost/scsi.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 9a1253b9d8c5..000000000000 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -2219,6 +2219,7 @@ static int vhost_scsi_set_features(struct vhost_scsi = *vs, u64 features) { struct vhost_virtqueue *vq; bool is_log, was_log; + u64 old_features; int i; =20 if (features & ~VHOST_SCSI_FEATURES) @@ -2234,6 +2235,14 @@ static int vhost_scsi_set_features(struct vhost_scsi= *vs, u64 features) if (!vs->dev.nvqs) goto out; =20 + old_features =3D vs->vqs[0].vq.acked_features; + if (vs->vs_tpg && + ((features ^ old_features) & + ~(1ULL << VHOST_F_LOG_ALL))) { + mutex_unlock(&vs->dev.mutex); + return -EBUSY; + } + is_log =3D features & (1 << VHOST_F_LOG_ALL); /* * All VQs should have same feature. --=20 2.43.0