[PATCH v2] vhost-scsi: serialize completion notification with callfd updates

[PATCH v2] vhost-scsi: serialize completion notification with callfd updates

[Jia Jia]

vhost_scsi_complete_cmd_work() drops the virtqueue mutex before calling
vhost_signal(). VHOST_SET_VRING_CALL replaces call_ctx.ctx and releases the
old eventfd_ctx while holding the same mutex. vhost_signal() reads the call
context before and after vhost_notify(), so a concurrent callfd update can
make it signal a freed context or NULL.

KASAN reported the use through:

	eventfd_signal_mask
	vhost_signal
	vhost_scsi_complete_cmd_work

The context was released through:

	eventfd_ctx_put
	vhost_vring_ioctl
	vhost_scsi_ioctl

Keep the mutex held through vhost_signal() so completion notification and
callfd updates are serialized.

Fixes: 057cbf49a1f0 ("tcm_vhost: Initial merge for vhost level target fabric driver")
Link: https://lore.kernel.org/r/20260720085306.1519294-1-physicalmtea@gmail.com
Signed-off-by: Jia Jia <physicalmtea@gmail.com>
---
Changes since RFC:
- Send as a non-RFC v2.
- Add Fixes and Link tags.

 drivers/vhost/scsi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 9a1253b9d8c5..7f46bc0de3c2 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -735,10 +735,9 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work)
 		vhost_scsi_release_cmd_res(se_cmd);
 	}
 
-	mutex_unlock(&svq->vq.mutex);
-
 	if (signal)
 		vhost_signal(&svq->vs->dev, &svq->vq);
+	mutex_unlock(&svq->vq.mutex);
 }
 
 static struct vhost_scsi_cmd *
-- 
2.34.1

Re: [PATCH v2] vhost-scsi: serialize completion notification with callfd updates

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 1207 bytes --]

On Thu, Aug 06, 2026 at 02:51:43PM +0800, Jia Jia wrote:
> vhost_scsi_complete_cmd_work() drops the virtqueue mutex before calling
> vhost_signal(). VHOST_SET_VRING_CALL replaces call_ctx.ctx and releases the
> old eventfd_ctx while holding the same mutex. vhost_signal() reads the call
> context before and after vhost_notify(), so a concurrent callfd update can
> make it signal a freed context or NULL.
> 
> KASAN reported the use through:
> 
> 	eventfd_signal_mask
> 	vhost_signal
> 	vhost_scsi_complete_cmd_work
> 
> The context was released through:
> 
> 	eventfd_ctx_put
> 	vhost_vring_ioctl
> 	vhost_scsi_ioctl
> 
> Keep the mutex held through vhost_signal() so completion notification and
> callfd updates are serialized.
> 
> Fixes: 057cbf49a1f0 ("tcm_vhost: Initial merge for vhost level target fabric driver")
> Link: https://lore.kernel.org/r/20260720085306.1519294-1-physicalmtea@gmail.com
> Signed-off-by: Jia Jia <physicalmtea@gmail.com>
> ---
> Changes since RFC:
> - Send as a non-RFC v2.
> - Add Fixes and Link tags.
> 
>  drivers/vhost/scsi.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]