[PATCH v2 0/2] vhost-scsi: fix max_io_vqs handling

[PATCH v2 0/2] vhost-scsi: fix max_io_vqs handling

[Dongli Zhang]

Avoid high-order kmalloc() allocations for the vhost-scsi virtqueue array,
and clamp out-of-range max_io_vqs updates so the stored value remains
within the supported range.

v1->v2:
  - Access vhost_scsi_max_io_vqs with READ_ONCE().
  - Clamp out-of-range max_io_vqs values instead of rejecting them.

Dongli Zhang (2):
  vhost-scsi: use kvzalloc for vq array allocation
  vhost-scsi: vhost-scsi: clamp max_io_vqs module parameter

 drivers/vhost/scsi.c | 49 ++++++++++++++++++++++++++++++++++-------------
 1 file changed, 36 insertions(+), 13 deletions(-)

base-commit: 2d2338c93da79b3bfe4b6099a931d9468d539952

Thank you very much!

Dongli Zhang

[PATCH v2 1/2] vhost-scsi: use kvzalloc for vq array allocation

[Dongli Zhang]

vhost_scsi_open() allocates one "struct vhost_scsi_virtqueue" for each
virtqueue. With large max_io_vqs values, this array can require a
high-order contiguous allocation and trigger a page allocator warning.

hv# cat /sys/module/vhost_scsi/parameters/max_io_vqs
256

[  766.075787] ------------[ cut here ]------------
[  766.077030] WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x32c/0x15c0, CPU#23: qemu-system-x86/5964
... ...
[  766.080351] RIP: 0010:__alloc_frozen_pages_noprof+0x32c/0x15c0
... ...
[  766.085813] Call Trace:
[  766.085969]  <TASK>
[  766.086098]  ? srso_alias_return_thunk+0x5/0xfbef5
[  766.086365]  ? context_struct_compute_av+0x38a/0x4b0
[  766.086652]  alloc_pages_mpol+0x9f/0x170
[  766.086883]  ___kmalloc_large_node+0xb6/0xd0
[  766.087124]  ? srso_alias_return_thunk+0x5/0xfbef5
[  766.087389]  __kmalloc_large_node_noprof+0x18/0xa0
[  766.087655]  __kmalloc_noprof+0x3a0/0x440
[  766.087877]  ? vhost_scsi_open+0xcb/0x2d0 [vhost_scsi]
[  766.088162]  vhost_scsi_open+0xcb/0x2d0 [vhost_scsi]
[  766.088449]  misc_open+0x123/0x160
[  766.088679]  chrdev_open+0xb1/0x230
[  766.088885]  ? __pfx_chrdev_open+0x10/0x10
[  766.089157]  do_dentry_open+0x11a/0x470
[  766.089389]  vfs_open+0x29/0xf0
[  766.089596]  path_openat+0x7c0/0x1100
[  766.089821]  do_file_open+0xdd/0x190
[  766.090032]  ? srso_alias_return_thunk+0x5/0xfbef5
[  766.090332]  do_sys_openat2+0x7e/0x100
[  766.090601]  __x64_sys_openat+0x51/0xa0
[  766.090857]  do_syscall_64+0xfe/0x590
[  766.091087]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  766.091411] RIP: 0033:0x7f9525a11fa6

The array does not require physical contiguity, so allocate it with
kvzalloc_objs() and free it with kvfree().

Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
---
 drivers/vhost/scsi.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 9a1253b9d8c5..0c0634eea144 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -2295,7 +2295,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
 	if (!vs->old_inflight)
 		goto err_inflight;
 
-	vs->vqs = kmalloc_objs(*vs->vqs, nvqs, GFP_KERNEL | __GFP_ZERO);
+	vs->vqs = kvzalloc_objs(*vs->vqs, nvqs);
 	if (!vs->vqs)
 		goto err_vqs;
 
@@ -2331,7 +2331,7 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
 	return 0;
 
 err_local_vqs:
-	kfree(vs->vqs);
+	kvfree(vs->vqs);
 err_vqs:
 	kfree(vs->old_inflight);
 err_inflight:
@@ -2352,7 +2352,7 @@ static int vhost_scsi_release(struct inode *inode, struct file *f)
 	vhost_dev_stop(&vs->dev);
 	vhost_dev_cleanup(&vs->dev);
 	kfree(vs->dev.vqs);
-	kfree(vs->vqs);
+	kvfree(vs->vqs);
 	kfree(vs->old_inflight);
 	kvfree(vs);
 	return 0;
-- 
2.43.5

Re: [PATCH v2 1/2] vhost-scsi: use kvzalloc for vq array allocation

[Mike Christie]

On 8/2/26 12:24 PM, Dongli Zhang wrote:
> vhost_scsi_open() allocates one "struct vhost_scsi_virtqueue" for each
> virtqueue. With large max_io_vqs values, this array can require a
> high-order contiguous allocation and trigger a page allocator warning.
> 
> hv# cat /sys/module/vhost_scsi/parameters/max_io_vqs
> 256
> 
> [  766.075787] ------------[ cut here ]------------
> [  766.077030] WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x32c/0x15c0, CPU#23: qemu-system-x86/5964
> ... ...
> [  766.080351] RIP: 0010:__alloc_frozen_pages_noprof+0x32c/0x15c0
> ... ...
> [  766.085813] Call Trace:
> [  766.085969]  <TASK>
> [  766.086098]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  766.086365]  ? context_struct_compute_av+0x38a/0x4b0
> [  766.086652]  alloc_pages_mpol+0x9f/0x170
> [  766.086883]  ___kmalloc_large_node+0xb6/0xd0
> [  766.087124]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  766.087389]  __kmalloc_large_node_noprof+0x18/0xa0
> [  766.087655]  __kmalloc_noprof+0x3a0/0x440
> [  766.087877]  ? vhost_scsi_open+0xcb/0x2d0 [vhost_scsi]
> [  766.088162]  vhost_scsi_open+0xcb/0x2d0 [vhost_scsi]
> [  766.088449]  misc_open+0x123/0x160
> [  766.088679]  chrdev_open+0xb1/0x230
> [  766.088885]  ? __pfx_chrdev_open+0x10/0x10
> [  766.089157]  do_dentry_open+0x11a/0x470
> [  766.089389]  vfs_open+0x29/0xf0
> [  766.089596]  path_openat+0x7c0/0x1100
> [  766.089821]  do_file_open+0xdd/0x190
> [  766.090032]  ? srso_alias_return_thunk+0x5/0xfbef5
> [  766.090332]  do_sys_openat2+0x7e/0x100
> [  766.090601]  __x64_sys_openat+0x51/0xa0
> [  766.090857]  do_syscall_64+0xfe/0x590
> [  766.091087]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
> [  766.091411] RIP: 0033:0x7f9525a11fa6
> 
> The array does not require physical contiguity, so allocate it with
> kvzalloc_objs() and free it with kvfree().
> 
> Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
Reviewed-by: Mike Christie <michael.christie@oracle.com>

[PATCH v2 2/2] vhost-scsi: clamp max_io_vqs module parameter

[Dongli Zhang]

max_io_vqs is currently validated only when a vhost-scsi device is opened.
This allows sysfs to show values larger than the driver will actually use,
e.g. writing 2048 succeeds even though vhost_scsi_open() later clamps it to
VHOST_SCSI_MAX_IO_VQ. This makes the sysfs value differ from the value that
will actually be used.

hv# echo 2048 > /sys/module/vhost_scsi/parameters/max_io_vqs

hv# cat /sys/module/vhost_scsi/parameters/max_io_vqs
2048

[  315.630495] Invalid max_io_vqs of 2048. Using 1024.

Keep accepting out-of-range values for compatibility, but clamp them in the
module parameter setter and store the effective value. This preserves the
existing behavior that invalid values do not make module loading or sysfs
writes fail. It also makes reads report the value that will actually be
used.

With the parameter value kept in range, remove the duplicate validation
from vhost_scsi_open().

Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
---
v1->v2:
  - Access vhost_scsi_max_io_vqs with READ_ONCE().
  - Clamp out-of-range max_io_vqs values instead of rejecting them.

 drivers/vhost/scsi.c | 43 +++++++++++++++++++++++++++++++++----------
 1 file changed, 33 insertions(+), 10 deletions(-)

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index 0c0634eea144..fb262cf9a34d 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -210,7 +210,37 @@ static const int vhost_scsi_bits[] = {
 #define VHOST_SCSI_MAX_EVENT	128
 
 static unsigned vhost_scsi_max_io_vqs = 128;
-module_param_named(max_io_vqs, vhost_scsi_max_io_vqs, uint, 0644);
+
+static int vhost_scsi_set_max_io_vqs(const char *val,
+				     const struct kernel_param *kp)
+{
+	unsigned int max_io_vqs;
+	int ret;
+
+	ret = kstrtouint(val, 0, &max_io_vqs);
+	if (ret)
+		return ret;
+
+	if (max_io_vqs > VHOST_SCSI_MAX_IO_VQ) {
+		pr_err("Invalid max_io_vqs of %u. Using %u.\n",
+		       max_io_vqs, VHOST_SCSI_MAX_IO_VQ);
+		max_io_vqs = VHOST_SCSI_MAX_IO_VQ;
+	} else if (!max_io_vqs) {
+		pr_err("Invalid max_io_vqs of 0. Using 1.\n");
+		max_io_vqs = 1;
+	}
+
+	WRITE_ONCE(vhost_scsi_max_io_vqs, max_io_vqs);
+	return 0;
+}
+
+static const struct kernel_param_ops vhost_scsi_max_io_vqs_op = {
+	.set = vhost_scsi_set_max_io_vqs,
+	.get = param_get_uint,
+};
+
+module_param_cb(max_io_vqs, &vhost_scsi_max_io_vqs_op,
+		&vhost_scsi_max_io_vqs, 0644);
 MODULE_PARM_DESC(max_io_vqs, "Set the max number of IO virtqueues a vhost scsi device can support. The default is 128. The max is 1024.");
 
 struct vhost_scsi_virtqueue {
@@ -2273,21 +2303,14 @@ static int vhost_scsi_open(struct inode *inode, struct file *f)
 	struct vhost_scsi_virtqueue *svq;
 	struct vhost_scsi *vs;
 	struct vhost_virtqueue **vqs;
-	int r = -ENOMEM, i, nvqs = vhost_scsi_max_io_vqs;
+	int r = -ENOMEM, i, nvqs;
 
 	vs = kvzalloc_obj(*vs);
 	if (!vs)
 		goto err_vs;
 	vs->inline_sg_cnt = vhost_scsi_inline_sg_cnt;
 
-	if (nvqs > VHOST_SCSI_MAX_IO_VQ) {
-		pr_err("Invalid max_io_vqs of %d. Using %d.\n", nvqs,
-		       VHOST_SCSI_MAX_IO_VQ);
-		nvqs = VHOST_SCSI_MAX_IO_VQ;
-	} else if (nvqs == 0) {
-		pr_err("Invalid max_io_vqs of %d. Using 1.\n", nvqs);
-		nvqs = 1;
-	}
+	nvqs = READ_ONCE(vhost_scsi_max_io_vqs);
 	nvqs += VHOST_SCSI_VQ_IO;
 
 	vs->old_inflight = kmalloc_objs(*vs->old_inflight, nvqs,
-- 
2.43.5

Re: [PATCH v2 2/2] vhost-scsi: clamp max_io_vqs module parameter

[Mike Christie]

On 8/2/26 12:24 PM, Dongli Zhang wrote:
> max_io_vqs is currently validated only when a vhost-scsi device is opened.
> This allows sysfs to show values larger than the driver will actually use,
> e.g. writing 2048 succeeds even though vhost_scsi_open() later clamps it to
> VHOST_SCSI_MAX_IO_VQ. This makes the sysfs value differ from the value that
> will actually be used.
> 
> hv# echo 2048 > /sys/module/vhost_scsi/parameters/max_io_vqs
> 
> hv# cat /sys/module/vhost_scsi/parameters/max_io_vqs
> 2048
> 
> [  315.630495] Invalid max_io_vqs of 2048. Using 1024.
> 
> Keep accepting out-of-range values for compatibility, but clamp them in the
> module parameter setter and store the effective value. This preserves the
> existing behavior that invalid values do not make module loading or sysfs
> writes fail. It also makes reads report the value that will actually be
> used.
> 
> With the parameter value kept in range, remove the duplicate validation
> from vhost_scsi_open().
> 
> Signed-off-by: Dongli Zhang <dongli.zhang@oracle.com>
> ---
> v1->v2:
>   - Access vhost_scsi_max_io_vqs with READ_ONCE().
>   - Clamp out-of-range max_io_vqs values instead of rejecting them.
> 
Reviewed-by: Mike Christie <michael.christie@oracle.com>

Re: [PATCH v2 0/2] vhost-scsi: fix max_io_vqs handling

[Stefan Hajnoczi]

[-- Attachment #1: Type: text/plain, Size: 830 bytes --]

On Sun, Aug 02, 2026 at 10:24:54AM -0700, Dongli Zhang wrote:
> Avoid high-order kmalloc() allocations for the vhost-scsi virtqueue array,
> and clamp out-of-range max_io_vqs updates so the stored value remains
> within the supported range.
> 
> v1->v2:
>   - Access vhost_scsi_max_io_vqs with READ_ONCE().
>   - Clamp out-of-range max_io_vqs values instead of rejecting them.
> 
> Dongli Zhang (2):
>   vhost-scsi: use kvzalloc for vq array allocation
>   vhost-scsi: vhost-scsi: clamp max_io_vqs module parameter
> 
>  drivers/vhost/scsi.c | 49 ++++++++++++++++++++++++++++++++++-------------
>  1 file changed, 36 insertions(+), 13 deletions(-)
> 
> base-commit: 2d2338c93da79b3bfe4b6099a931d9468d539952
> 
> Thank you very much!
> 
> Dongli Zhang
> 

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]