Thank you for your contribution! Sashiko AI review found no new issues in this patch, but noticed 1 related pre-existing issue it does not introduce: - [High] vhost-scsi: unhandled vhost_vq_init_access() failure in vhost_scsi_set_endpoint() [1] --
commit b696a8fa1d0b9b5e5c27a63e36f3d5e5c268720d Author: Yuho Choi <[email protected]> vhost-scsi: do not validate vrings during endpoint teardown This commit removes the vhost_vq_access_ok() check from vhost_scsi_clear_endpoint() so that endpoint teardown always disables the virtqueue backends and waits for in-flight SCSI commands before state is freed. > diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c > index e44044449cef8..f0966f25b09a9 100644 > --- a/drivers/vhost/scsi.c > +++ b/drivers/vhost/scsi.c > @@ -2194,17 +2194,10 @@ vhost_scsi_clear_endpoint(struct vhost_scsi *vs, > struct vhost_scsi_tpg *tpg; > struct vhost_virtqueue *vq; > bool match = false; > - int index, ret, i; > + int ret, i; > u8 target; > > mutex_lock(&vs->dev.mutex); > - /* Verify that ring has been setup correctly. */ > - for (index = 0; index < vs->dev.nvqs; ++index) { > - if (!vhost_vq_access_ok(&vs->vqs[index].vq)) { > - ret = -EFAULT; > - goto err_dev; > - } > - } > > if (!vs->vs_tpg) { > ret = 0; [Severity: High] This problem wasn't introduced by this patch, but should the paired vhost_scsi_set_endpoint() path check the return value of vhost_vq_init_access() [1]? drivers/vhost/scsi.c:vhost_scsi_set_endpoint() { ... for (i = 0; i < vs->dev.nvqs; i++) { vq = &vs->vqs[i].vq; if (i >= VHOST_SCSI_VQ_IO && !vs->vqs[i].scsi_cmds) continue; mutex_lock(&vq->mutex); vhost_vq_set_backend(vq, vs_tpg); vhost_vq_init_access(vq); mutex_unlock(&vq->mutex); } ... } If userspace invokes VHOST_SCSI_SET_ENDPOINT before configuring the vring addresses, vhost_vq_init_access() fails for the control and event virtqueues while their backends remain set to vs_tpg, leaving last_used_idx uninitialized and breaking event delivery and control command handling. [1] https://sashiko.dev/#/bug/linux-00d9df6c-e264-4a85-ae70-5ede3bace73b -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
