>
> On Sun, Oct 11, 2026 at 09:48:03AM +0800, Jia Jia wrote:
> > vhost_scsi_handle_vq() moves pi_bytesout or pi_bytesin into the
> > protection sgl and subtracts those bytes from exp_data_len. The length
> > passed to TCM is still exp_data_len + prot_bytes.
> >
> > prot_bytes comes from virtio_scsi_cmd_req_pi. With
> > VIRTIO_SCSI_F_T10_PI negotiated, vhost reads that header and does not
> > check that the CDB is a READ or WRITE. sbc_check_prot() replaces
> > data_length from the CDB only when the protect field is non-zero.
> > target_cmd_size_check() leaves a write's data_length unchanged when the
> > CDB size is smaller, so a command that does not get that replacement
> > keeps a data_length larger than the data sgl.
> >
> > The KASAN report is a MODE SELECT whose header had pi_bytesout set.
> > The data sgl held only the parameter list. spc_emulate_modeselect()
> > walked data_length and read the next physical page.
> >
> > Pass the data sgl length. Protected READ and WRITE still take their
> > length from the CDB in sbc_check_prot().
> >
> > KASAN reports:
> >
> > BUG: KASAN: use-after-free in spc_emulate_modeselect+0x145/0x380
> > [target_core_mod]
> > Read of size 1
> >
> > spc_emulate_modeselect
> > __target_execute_cmd
> > target_execute_cmd
> > vhost_scsi_write_pending
> > transport_generic_new_cmd
> > __target_submit
> > target_queued_submit_work
> > process_one_work
> > worker_thread
> > kthread
> > ret_from_fork
> > ret_from_fork_asm
> >
> > Fixes: 9f977ef7b671 ("vhost-scsi: Include prot_bytes into expected data
> > transfer length")
> > Signed-off-by: Jia Jia <[email protected]>
> > ---
> > v2:
> > - Drop the claim that target used to subtract prot_length.
> > 9f977ef7b671 cites 14ef9200, which is not in the tree
> > - prot_bytes comes from virtio_scsi_cmd_req_pi
>
>
> you can mention the other patches you sent fixing
> security maybe this will calm down sashiko.
>
Will do, thanks.
> >
> > drivers/vhost/scsi.c | 8 ++++++--
> > 1 file changed, 6 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
> > index 4f8c0260bc9e..4bd29c2ceed9 100644
> > --- a/drivers/vhost/scsi.c
> > +++ b/drivers/vhost/scsi.c
> > @@ -1534,9 +1534,13 @@ vhost_scsi_handle_vq(struct vhost_scsi *vs, struct
> > vhost_virtqueue *vq)
> > * vhost_scsi_queue_data_in() and vhost_scsi_queue_status()
> > */
> > cmd->tvc_vq_desc = vc.head;
> > + /*
> > + * exp_data_len is the data sgl. prot_bytes already sit in
> > + * the protection sgl. Protected READ and WRITE replace
> > + * data_length from the CDB in sbc_check_prot().
>
> this is barely readable - could you improve pls? even if that makes it
> a bit more verbose.
>
Thanks for the reminder. I'll improve it.
>
>
>
> > + */
> > vhost_scsi_target_queue_cmd(nexus, cmd, cdb, lun, task_attr,
> > - data_direction,
> > - exp_data_len + prot_bytes);
> > + data_direction, exp_data_len);
> > ret = 0;
> > err:
> > /*
> > --
> > 2.53.0
>
