github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

virtio-blk: clamp max_segments to virtqueue ring size

Browse Source 
In virtblk_add_req(), each request consumes 2 extra descriptors (out_hdr
and in_hdr) in addition to the data scatter-gather segments.

When a hypervisor (e.g. QNX Hypervisor) advertises VIRTIO_BLK_F_SEG_MAX
with seg_max = 1024 alongside a 1024-entry split ring (vring.num = 1024)
and VIRTIO_RING_F_INDIRECT_DESC disabled, lim->max_segments is set to
1024. When the block layer submits requests with 1023 or 1024 data
segments, total_sg reaches 1025 or 1026. This exceeds vring.num (1024),
causing virtqueue_add_split() to return -ENOSPC and permanently wedge
the blk-mq queue.

Furthermore, the Virtio specification (2.7.5.3.1) requires that a
descriptor chain never exceed the Queue Size, and virtqueue_add_split()
falls back to direct descriptors if indirect table allocation fails.

Fix this by:
1. Rejecting queues with ring_size < 3 at probe, or
   ring_size < (queue_max_segments + 2) during resume/reset recovery in
   init_vq().
2. Unconditionally clamping sg_elems to (ring_size - 2) across all
   virtqueues in virtblk_read_limits().

Reported-by: Stjepan Poljak <stjepan.poljak@gmail.com>
Fixes: 0864b79a15 ("virtio: block: dynamic maximum segments")
Signed-off-by: Sergii Ushakov <sergiiushakov@google.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20260918135120.1261150-1-sergiiushakov@google.com>
This commit is contained in:
Sergii Ushakov 2026-09-18 15:51:20 +02:00 committed by Michael S. Tsirkin
parent c9c1c1b7b3
commit 434d2bc41b
1 changed files with 43 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

44
drivers/block/virtio_blk.c
View File

@ -1022,6 +1022,30 @@ static int init_vq(struct virtio_blk *vblk)
goto out;
for (i = 0; i < num_vqs; i++) {
unsigned int ring_size = virtqueue_get_vring_size(vqs[i]);
/*
* Each request consumes 2 extra descriptors (out_hdr and
* in_hdr) in addition to the data segments.
*
* At initial probe (!vblk->disk), each virtqueue must fit at
* least 1 data segment + 2 header descriptors (3).
* On resume/recovery (vblk->disk), each virtqueue must fit the
* existing queue_max_segments() + 2 header descriptors.
*/
unsigned int min_ring_size = 3;
if (vblk->disk)
min_ring_size = queue_max_segments(vblk->disk->queue) + 2;
if (ring_size < min_ring_size) {
dev_err(&vdev->dev,
"virtqueue %u ring size %u is smaller than minimum %u\n",
i, ring_size, min_ring_size);
vdev->config->del_vqs(vdev);
err = -EINVAL;
goto out;
}
spin_lock_init(&vblk->vqs[i].lock);
vblk->vqs[i].vq = vqs[i];
}
@ -1254,7 +1278,7 @@ static int virtblk_read_limits(struct virtio_blk *vblk,
u16 min_io_size;
u8 physical_block_exp, alignment_offset;
size_t max_dma_size;
int err;
int err, i;
/* We need to know how many segments before we allocate. */
err = virtio_cread_feature(vdev, VIRTIO_BLK_F_SEG_MAX,
@ -1268,6 +1292,23 @@ static int virtblk_read_limits(struct virtio_blk *vblk,
/* Prevent integer overflows and honor max vq size */
sg_elems = min_t(u32, sg_elems, VIRTIO_BLK_MAX_SG_ELEMS - 2);
/*
* virtblk_add_req() uses separate outgoing and incoming header
* descriptors (out_hdr and in_hdr), consuming 2 extra descriptors
* per request in addition to the data segments.
*
* Per virtio specification (2.7.5.3.1), a driver MUST NOT create a
* descriptor chain longer than the Queue Size of the device.
*
* Clamp max_segments to (ring_size - 2) across all virtqueues so
* that a request never exceeds the ring size of any queue.
*/
for (i = 0; i < vblk->num_vqs; i++) {
u32 ring_size = virtqueue_get_vring_size(vblk->vqs[i].vq);
sg_elems = min_t(u32, sg_elems, ring_size - 2);
}
/* We can handle whatever the host told us to handle. */
lim->max_segments = sg_elems;
@ -1467,6 +1508,7 @@ static int virtblk_probe(struct virtio_device *vdev)
mutex_init(&vblk->vdev_mutex);
vblk->vdev = vdev;
vblk->disk = NULL;
INIT_WORK(&vblk->config_work, virtblk_config_changed_work);