From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 94ADEC982EE for ; Mon, 21 Sep 2026 14:30:53 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1x8f2B-0002wa-VX; Mon, 21 Sep 2026 10:30:20 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x8f0p-0001wl-V2; Mon, 21 Sep 2026 10:29:01 -0400 Received: from tor.source.kernel.org ([172.105.4.254]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1x8f0o-00008m-47; Mon, 21 Sep 2026 10:28:55 -0400 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) by tor.source.kernel.org (Postfix) with ESMTP id 2BB3E600C8; Mon, 21 Sep 2026 14:28:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CDFB91F000FF; Mon, 21 Sep 2026 14:28:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1790000932; bh=4r/SaucnpBOavEClkEVL9hzC9PZEiZbcsuE88gfYWSE=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=cLquR0s043VDphJuLCsFQAMug3d+xh2WgwzTSI8jXXXGGbHh4fLGnRvuCV3VrayXf 4eTwq4PnMYQaX98Gj1xPgD1C8bzNzm7jE1xaGRot7Y5MeSuW+xnHzKQdQ11rjdlkek KhRQr3zcNXkKBcDSiRVLmSUhRvKZlBeZ1U8caFV7O4rt/jHlMgpk1ljo2jhRNpPVbM ePOi4i9q8rILmXUmFFHahDwAYD7Ufo4JcwW1qYjldkVvGAyara3ISoYMLr7NLx79OG 8wOPGUzlJ6PSzjePjvyAi5exnhHLEahtD5zFx1xYVdfdYI/MUCrO0suvWpbf40GAB6 sYqDQe3SkBpuQ== From: Niklas Cassel To: Stefan Hajnoczi , Kevin Wolf , "Michael S. Tsirkin" , Hanna Reitz Cc: Sam Li , Damien Le Moal , Niklas Cassel , qemu-block@nongnu.org, qemu-devel@nongnu.org Subject: [PATCH v6 06/15] virtio-blk: check the write granularity of writes to sequential zones Date: Mon, 21 Sep 2026 16:28:08 +0200 Message-ID: <20260921142819.2916043-7-cassel@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260921142819.2916043-1-cassel@kernel.org> References: <20260921142819.2916043-1-cassel@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=172.105.4.254; envelope-from=cassel@kernel.org; helo=tor.source.kernel.org X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org All VIRTIO_BLK_T_OUT requests issued to sequential zones and all VIRTIO_BLK_T_ZONE_APPEND requests must have an offset and a data size that are multiples of the write granularity reported by the device (virtio 1.4, 5.2.6.1), and a violation is reported as VIRTIO_BLK_S_ZONE_UNALIGNED_WP (virtio 1.4, 5.2.6). Neither request type was fully checked. Zone appends validated only the offset, while writes were not checked at all. Check the size of the appended data, and both the offset and the size of a write, against blkconf_zone_write_granularity(), so that every request the device accepts is one that the guest driver was told is valid. Writes to conventional zones keep no alignment constraint beyond the logical block size. The write path performs the check after virtio_blk_sect_range_ok() so that the zone index derived from the guest supplied sector is known to be in range. Reviewed-by: Damien Le Moal Reviewed-by: Stefan Hajnoczi Signed-off-by: Niklas Cassel --- hw/block/virtio-blk.c | 38 +++++++++++++++++++++++++++++++++++++- 1 file changed, 37 insertions(+), 1 deletion(-) diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c index 6bf1049aea..449de307b4 100644 --- a/hw/block/virtio-blk.c +++ b/hw/block/virtio-blk.c @@ -392,6 +392,33 @@ static bool virtio_blk_sect_range_ok(VirtIOBlock *dev, return true; } +/* + * Both the offset and the size of a write to a sequential zone must be a + * multiple of the write granularity that the device reports. Conventional + * zones are not constrained. The zone index is derived from a guest supplied + * sector, so this must only be called once virtio_blk_sect_range_ok() has + * bounded it. + */ +static bool virtio_blk_zone_write_granularity_ok(VirtIOBlock *dev, + uint64_t sector, size_t size) +{ + BlockDriverState *bs = blk_bs(dev->blk); + uint64_t offset = sector << BDRV_SECTOR_BITS; + uint32_t wg_mask; + + if (bs->bl.zoned == BLK_Z_NONE) { + return true; + } + + if (bdrv_zone_is_conv(bs, bdrv_zone_index(bs, offset))) { + return true; + } + + wg_mask = blkconf_zone_write_granularity(&dev->conf.conf) - 1; + + return !(offset & wg_mask) && !(size & wg_mask); +} + static uint8_t virtio_blk_handle_discard_write_zeroes(VirtIOBlockReq *req, struct virtio_blk_discard_write_zeroes *dwz_hdr, bool is_write_zeroes) { @@ -518,7 +545,7 @@ static bool check_zoned_request(VirtIOBlock *s, int64_t offset, int64_t len, if (append) { uint32_t wg_mask = blkconf_zone_write_granularity(&s->conf.conf) - 1; - if (offset & wg_mask) { + if (offset & wg_mask || len & wg_mask) { *status = VIRTIO_BLK_S_ZONE_UNALIGNED_WP; return false; } @@ -913,6 +940,15 @@ static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb) return 0; } + if (is_write && + !virtio_blk_zone_write_granularity_ok(s, req->sector_num, + req->qiov.size)) { + virtio_blk_req_complete(req, VIRTIO_BLK_S_ZONE_UNALIGNED_WP); + block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_WRITE); + g_free(req); + return 0; + } + block_acct_start(blk_get_stats(s->blk), &req->acct, req->qiov.size, is_write ? BLOCK_ACCT_WRITE : BLOCK_ACCT_READ); -- 2.55.0