Re: [PATCH] vhost-scsi: fix event queue iov out-of-bounds

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Self-deadlock (AA deadlock) in vhost_scsi_send_evt when vhost_vq_work_queue fails.
--

commit c17fff972ec26b541af9ec7b514db052328d64e6
Author: Jia Jia <physicalmtea@gmail.com>

vhost-scsi: fix event queue iov out-of-bounds

This commit fixes an array-index-out-of-bounds issue in vhost_scsi_do_evt_work()
by ensuring there is at least one input descriptor before indexing the iov array.
It treats pure-output chains as missed events to prevent reading past the end
of the array.

> diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
> index 7a1f39a327da6..5a0863d560a07 100644
> --- a/drivers/vhost/scsi.c
> +++ b/drivers/vhost/scsi.c
> @@ -608,9 +608,10 @@ vhost_scsi_do_evt_work(struct vhost_scsi *vs, struct vhost_scsi_evt *evt)
>  		return;
>  	}
>  
> -	if ((vq->iov[out].iov_len != sizeof(struct virtio_scsi_event))) {
> +	if (!in ||
> +	    vq->iov[out].iov_len != sizeof(struct virtio_scsi_event)) {

[Severity: High]
This is a pre-existing issue, but while reviewing this event handling code, I
noticed a potential self-deadlock scenario.

If vhost_scsi_send_evt() is called from a path that already holds vq->mutex,
like vhost_scsi_evt_handle_kick():

vhost_scsi_evt_handle_kick()
    mutex_lock(&vq->mutex);
    ...
    if (vs->vs_events_missed)
        vhost_scsi_send_evt(...)

And vhost_scsi_send_evt() falls back to vhost_scsi_complete_events() because
vhost_vq_work_queue() returns false (for instance, if vq->worker is NULL):

vhost_scsi_send_evt()
    if (!vhost_vq_work_queue(vq, &vs->vs_event_work))
        vhost_scsi_complete_events(vs, true);

vhost_scsi_complete_events() then attempts to take the exact same mutex:

vhost_scsi_complete_events()
    mutex_lock(&vq->mutex);

Could this sequence cause a self-deadlock where the kernel thread hangs
indefinitely waiting on the non-recursive vq->mutex, potentially leading to a
denial of service?

>  		vq_err(vq, "Expecting virtio_scsi_event, got %zu bytes\n",
> -				vq->iov[out].iov_len);
> +		       in ? vq->iov[out].iov_len : 0);
>  		vs->vs_events_missed = true;
>  		return;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260904005240.502787-1-physicalmtea@gmail.com?part=1