diff options
| author | Linfeng Sun <linfeng.sun.dev@gmail.com> | 2026-10-10 20:22:58 +0800 |
|---|---|---|
| committer | Michael S. Tsirkin <mst@redhat.com> | 2026-11-03 07:32:13 -0500 |
| commit | a543346b96a174fcee6812ac2764acc8dc993358 (patch) | |
| tree | 9da021502a298ac6f4b892dbc57372fd9b0afe7f /scripts/Makefile.thinlto | |
| parent | e498eb93f961db1a1dfdabd373500f0d4019c9a4 (diff) | |
| download | linux-next-a543346b96a174fcee6812ac2764acc8dc993358.tar.gz linux-next-a543346b96a174fcee6812ac2764acc8dc993358.zip | |
vhost-scsi: reject delayed virtqueue setup
vhost_scsi_set_endpoint() allocates command pools only for I/O
virtqueues that are already set up, but publishes the backend for every
virtqueue. Userspace can complete a skipped queue after attaching the
endpoint, then kick it with scsi_tags uninitialized and trigger the
alloc_hint warning in sbitmap_get().
Delayed virtqueue setup is not supported. Leave skipped I/O virtqueues
inactive and reject changes to the vring size or addresses while an
endpoint is attached. Userspace must clear the endpoint before changing
the vring configuration.
I found this bug myself, though the patch was written with AI assistance.
Fixes: 25b98b64e284 ("vhost scsi: alloc cmds per vq instead of session")
Assisted-by: OpenAI-Codex:GPT-5.6
Signed-off-by: Linfeng Sun <linfeng.sun.dev@gmail.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20261010-fix-warning-in-sbitmap_get-v3-1-33de562d1359@gmail.com>
Diffstat (limited to 'scripts/Makefile.thinlto')
0 files changed, 0 insertions, 0 deletions