Re: [PATCH v7 00/22] vhost refactoring and fixes

["Michael S. Tsirkin" <mst@redhat.com>]

On Fri, Nov 06, 2026 at 03:53:38AM -0500, Oleg Drokin wrote:
> Hi Michael,
> 
> these master commits fix bugs that are also present in 10.0.x and are
> not in staging-10.0 yet.
> Group A cherry-picks cleanly onto staging-10.0 at 1607144131, in this
> order, and builds. Group B does not apply as is.
> 
> ## A. Clean cherry-picks
> 
> Guest-triggerable:
> 
> - 62976e8a2e virtio-pci: reject Q_ENABLE write on already-enabled queue
>   (re-enabling a live queue keeps stale progress indices; virtio-iommu
> can be driven to OOM)

this one is more of a work around. the real fixes for this are in
virtio-iommu.

> - fa9e186ab6 virtio-net: validate IHL in virtio_net_rsc_extract_unit4
> before use (OOB read, work item #4166; needs guest_rsc_ext)

ok

> - a2fbf1785b hw/ide/ahci: clear cur_cmd when the command list is
> unmapped
> - d7f16bad8f hw/ide/ahci: refuse a PIO transfer with no command header
> - 2713717148 hw/ide/ahci: treat a failed PRDT walk as a PIO transfer
> failure
> - 795af987ce hw/ide/ahci: reject a command header with an invalid FIS
> length
> - 402fd5a756 vfio/pci: Fix information leak in vfio_rom_read()
> - aca4967567 hw/usb/hcd-xhci: Unmap canceled packet (DMA mapping leak
> on Stop Endpoint with async packets)
> Host-side robustness:
> 
> - c31a445749 aio-posix: fix fdmon-io_uring.c timeout stack variable
> lifetime
> - dbf70f0a03 aio-posix: fix race between io_uring CQE and AioHandler
> deletion (10.0 uses fdmon-io_uring for every AioContext when built with
> liburing; random hangs and a use-after-free)
> - 1423c170b9 chardev: Fix QIOChannel refcount (use-after-free)
> - 3f0170505e chardev: Don't attempt to unregister yank function more
> than once (abort)
> - a1708203b5 net/tap-linux.c: avoid abort when setting invalid fd (the
> abort became reachable on reset through "virtio: Call set_features
> during reset", which 10.0.x carries)
> - 4733cb0833 block/io: skip head/tail requests on EINVAL (misaligned
> guest discard pauses a werror=stop guest)
> - 1fec1f337a ahci: Fix leak of IRQState (minor)
> 
> ## B. Need a context backport
> 
> - 9daa7347ff vfio/pci: Reject invalid MSI-X Table and PBA BIR values
>   (conflicts only with the vfio_device_get_irq_info() conversion)
> - 5bdc12fed5 hw/ide/ahci: drain the ports on teardown (use-after-free
> on surprise removal of a hot-plugged AHCI controller)
> - a35c5755d9 intel_iommu: fix guest-triggerable abort on oversized MMIO
> access

hmm. maybe

> - 24b9ebd5f1 hpet: fix bounds check for s->timer[] (no security impact
> per the commit message; included for completeness)
> 
> On Fri, 2026-11-06 at 05:35 +0300, Michael Tokarev wrote:
> > On 5/27/26 09:16, Vladimir Sementsov-Ogievskiy wrote:
> > > Hi all. That's a preparation for vhost-user-blk backend-transfer
> > > feature.
> > > 
> > > 07: rebase on master,
> > > 04: drop extra occurence of system_virtio_ss.add(files('vhost-user-
> > > stub.c'))
> > > 
> > > Vladimir Sementsov-Ogievskiy (22):
> > >    vhost-user: rework enabling vrings
> > >    vhost: drop backend_features field
> > >    vhost-user: introduce vhost_user_has_protocol_feature() helper
> > >    vhost: move protocol_features to vhost_user
> > >    vhost-user-gpu: drop code duplication
> > >    vhost: make vhost_dev.features private
> > >    virtio: move common part of _set_guest_notifier to generic code
> > >    virtio: drop *_set_guest_notifier_fd_handler() helpers
> > >    vhost-user: keep QIOChannelSocket for backend channel
> > >    vhost: vhost_virtqueue_start(): fix failure path
> > >    vhost: make vhost_memory_unmap() null-safe
> > >    vhost: simplify calls to vhost_memory_unmap()
> > >    vhost: move vrings mapping to the top of vhost_virtqueue_start()
> > >    vhost: vhost_virtqueue_start(): drop extra local variables
> > >    vhost: final refactoring of vhost vrings map/unmap
> > >    vhost: simplify vhost_dev_init() error-path
> > >    vhost: move busyloop timeout initialization to
> > > vhost_virtqueue_init()
> > >    vhost: vhost_dev_init(): simplify features initialization
> > >    hw/virtio/virtio-bus: refactor virtio_bus_set_host_notifier()
> > >    vhost-user: make trace events more readable
> > >    vhost-user-blk: add some useful trace-points
> > >    vhost: add some useful trace-points
> >  From this pullreq, I'm picking the following changes for 10.0.x
> > stable series
> > (with small adjustments to apply to 10.0.x):
> > 
> >   4e61c89262a vhost: final refactoring of vhost vrings map/unmap
> >   4801e50cf1a vhost: vhost_virtqueue_start(): drop extra local
> > variables
> >   60abdf60d50 vhost: move vrings mapping to the top of
> > vhost_virtqueue_start()
> >   060ef8cac11 vhost: simplify calls to vhost_memory_unmap()
> >   558084367e9 vhost: make vhost_memory_unmap() null-safe
> >   c85f42703df vhost: vhost_virtqueue_start(): fix failure path
> > 
> > Additionally, I'm picking
> > 
> >   41d5e37e0e2 hw/virtio/vhost: Replace legacy
> > cpu_physical_memory_*map() calls
> > 
> > to 10.0.x too - this is basically a no-op change, but it makes
> > subsequent changes to apply cleanly and makes older code closer
> > to current, simplifying back-porting and making this back-
> > porting easily verifiable.
> > 
> > Please take a look at the 6 top commits starting
> > 
> >  
> > https://gitlab.com/mjt0k/qemu/-/commits/16071441316f92915dccf08dabdddc722674e38c
> > 
> > -- it should be very similar to the changes in this pull request, but
> > a quick look is appreciated anyway.
> > 
> > Is there anything else in this area which should be picked up too? 
> > Maybe
> > some subsequent fixes?
> > 
> > Thanks,
> > 
> > /mjt