From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pj1-f48.google.com (mail-pj1-f48.google.com [209.85.216.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D5BF42A145 for ; Fri, 17 Jul 2026 14:22:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298137; cv=none; b=vClU68YGd3Xtev9hpv4TiDYvU+e3PoLyD8oBZ8jsQZqrmen8NOmpHpJtx6Th0dlSyH6Bsb1XhvQlGLsFshCpfYJtX+3U1n7OncAFW2gDRNWzDrxgHH6QaLQUMGRNUOsRhnzmbPR9B3xuEZ7I4aq9ltG2jcvJmpgcK+S6Dnx5X6s= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784298137; c=relaxed/simple; bh=7kow3xJStgv3CCEwPVH94AHQZCvexA38wioGE90Sw6U=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=fjjtFpnLA/i6X54Lb21DWwwn9AT/kvCdaH3EVKbrUQOrGkOv6f8N63rA+3T4tujrQm9+rvCa7rs9nbaK4XR/qp3FMP/I3k1heH9CCcnETevBCxA0kJMEK5LJqkNXqsFD7+SwiEpN+zEQkPyBYqwhkqIf4wXcJft05jBtIbQPCLM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=k+uDacnM; arc=none smtp.client-ip=209.85.216.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="k+uDacnM" Received: by mail-pj1-f48.google.com with SMTP id 98e67ed59e1d1-38125cebfdaso4880229a91.1 for ; Fri, 17 Jul 2026 07:22:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784298135; x=1784902935; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Ye+2o/nLKhbl8EFiB/65QBjN6Z27bE/oD+7iGYaj4l0=; b=k+uDacnMuUWqF/WA/cN2H1c7Ym5Sg2/1g3VJJvl+SvPGxKBv44jXNlYUFvcL0A4Vv2 Aqpzu1WaNnU0V6AQsrSTvt+z4Xv2txDIxViGjHj4iYKAW2UTdb7HGkwJ75BF2PYCw44b KktPl/U2XgAVYUa0903TwsTRFvvC96e7wRzUsWkpcSBrI1HNTnwOvsH0yIf9Rmiwr7xz +czaKSfSCDQEUgYeKc5BJCkD8HLRfvNC/JUjrrCTmqxi60Tsz7clQOT5chEpGqrZ9ws0 UCT1tg5nZBKtOZVYI2x3ToWVyJ/oUjWQntzMqtTS8AWAytixyU7djLtjTKVDzJn3X5n1 w0YQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784298135; x=1784902935; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Ye+2o/nLKhbl8EFiB/65QBjN6Z27bE/oD+7iGYaj4l0=; b=FPCJVi9VOQDvMzzDEu/ZhxQsi4tcBTo4sAOjZlzFvQP60k9UUO3Z4NrJ1JkD9qK2iR +uLJk9LZ5VjtGWaZFJjHH3NCz3gMM1SMBgxnH0dtlFJu4PJzgKe3wXLQr3/jeypV3zzL +NiUzVCJ30/2ED26JSPiH3dfNJn0UZlOl4Gr1V3xCEN3AdqDZ+Wxorg3Aol1XWPgQXNg ceelFRiKWgvFPB29KqdzNBDh06zjQLs6QAyQ229Ki8EJpk/p3ZQ/QRBxwFoNq0AfnP+X nm8IXdFJmjLGf+ePkJfS4OpK8+vYe7T0Vxp/WtbP5bcIOmey9xdAlBQIPICbQX8gVAKf 4axw== X-Forwarded-Encrypted: i=1; AHgh+Ro9zwiGVjqbE9FyIq9xWfZ3xbvHVnMM/jiNpICvJxPq/kvys1R4PObJDQfOvFcbWQatV+g0DJPPJDUsTsM=@vger.kernel.org X-Gm-Message-State: AOJu0YzWqLHHR4JjVDCnxQSfF3yKJcjPJrTGuPOTADVDJ/dYQqMa7oSU ut60oDKyZLCwq8rzuj/QHcigP9jniyXF9/1sDufRCkLIyBNkNVufgv2T X-Gm-Gg: AfdE7ckDvr3RdyvSmXFx3pC+ZudMFVPmLJ9fygkAhv4GX7Sy9fviir945XIA9gAiWEa 6JEk1bu/PyuBS7gEkjYpRly3044wabF5n4iBnIBuEyEWjgDTYkB5R3hKt8YWYOVCasajb6ONMt8 i9+d0BvOqIuzL0JgSC0pY2uhRYe/Qdil/9VFWNyYWAoQY8vNmUfoIpb0sEeui1O5L7vUkM3ZDXA jp8+ffU4RnuVrCbV1cBTk0olMT6nXCd6BAPh41Q4pE0oTnef5pPmTaCgwvBmkAxXMr1vSrEiwbr l/U38RiqnD9ZM0nc5JGwcDqHqIqyed6TsSkM5cn/+xptQFaEKgXRhnD7JL8qK6vyZYarW8gsCy8 K1tb6/swTw2oVFjrtCpwoWBoe1pZloWkHCMShq7EYTI4TMOet5gI7HYNmGd/IeqpHvf2j4E0yYK 7NC7i0 X-Received: by 2002:a17:90b:1dc3:b0:384:5b5b:3465 with SMTP id 98e67ed59e1d1-38e4b5792e4mr3066215a91.29.1784298134525; Fri, 17 Jul 2026 07:22:14 -0700 (PDT) Received: from [127.0.1.1] ([188.253.12.32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-38e39de785dsm3009325a91.4.2026.07.17.07.22.10 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 07:22:14 -0700 (PDT) From: Jia Jia To: mst@redhat.com, jasowang@redhat.com, michael.christie@oracle.com Cc: pbonzini@redhat.com, stefanha@redhat.com, eperezma@redhat.com, virtualization@lists.linux.dev, kvm@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: [PATCH] vhost-scsi: Prevent OOM from invalid protection SGL count Date: Fri, 17 Jul 2026 22:22:05 +0800 Message-Id: <20260717142205.103515-1-physicalmtea@gmail.com> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The protection SGL path passes the result of vhost_scsi_calc_sgls() directly to sg_alloc_table_chained(). The helper returns a negative errno when the iterator is invalid or the request exceeds the segment limit. The negative errno is then treated as a very large unsigned count and sends the request into the SGL allocation path with an invalid size. Repeated malformed T10-PI submissions from a host-side application caused memory usage to rise sharply. MemAvailable fell to about 200 MB, and PSI full avg10 reached about 1.46. The OOM killer terminated several userspace processes before the endpoint cleanup completed. The kernel log included: [17036.451028] Out of memory: Killed process 2345 (systemd) [17036.493325] Out of memory: Killed process 2349 (sd-pam) [17078.265127] Out of memory: Killed process 1793 (networkd-dispat) Return the calculation error before setting up the protection SGL. This keeps the protection path consistent with the data SGL path and prevents the invalid count from entering the allocation path. Fixes: bca939d5bcd0 ("vhost-scsi: Dynamically allocate scatterlists") Cc: stable@vger.kernel.org Signed-off-by: Jia Jia --- drivers/vhost/scsi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 9a1253b9d..8486652fd 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -972,6 +972,9 @@ vhost_scsi_mapal(struct vhost_scsi *vs, struct vhost_scsi_cmd *cmd, if (prot_bytes) { sgl_count = vhost_scsi_calc_sgls(prot_iter, prot_bytes, VHOST_SCSI_PREALLOC_PROT_SGLS); + if (sgl_count < 0) + return sgl_count; + cmd->prot_table.sgl = cmd->prot_sgl; ret = sg_alloc_table_chained(&cmd->prot_table, sgl_count, cmd->prot_table.sgl, -- 2.43.0