From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f179.google.com (mail-pl1-f179.google.com [209.85.214.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9187D284B29 for ; Sat, 18 Jul 2026 04:14:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.179 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784348099; cv=none; b=Zzwjq4JxuyVZC1h09jWGHMvOfPHkKItxCQwlsAaaIbAhBYEv5mYAe9YrIxabcmj7STv8ch97P2pooVy2bpfxrD+rbgDh7HOShMBHA0PZnkOTkb2tfTGhuekuun/+K4mbTa5r3dxNIqsDI2zzVzBE94c+ShkhWSxGRf6XsFmU95c= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784348099; c=relaxed/simple; bh=Ou3HEIiPKm38QTThdCiEvMGnc5Ln3dOxrXgAJKXHIXE=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=deGH+2UhQwzj2IghvwWZ/CMxGpWed+r+Ke/KUjfd7a7wzANlj46UDqCQ21UNCtFQuwa8ME9Yx1L4LChUfEjeRJGFwqGK0FYCHrN0Z8Ehu5dq5xVyZSsYw3iOY/5jhtXlQlly46TVmHm3P8BfWUdyGDyxoyOTeD4qakMSC/Vvr4k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=o//Xbj7+; arc=none smtp.client-ip=209.85.214.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="o//Xbj7+" Received: by mail-pl1-f179.google.com with SMTP id d9443c01a7336-2cc97653887so95367025ad.1 for ; Fri, 17 Jul 2026 21:14:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784348098; x=1784952898; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=kJkPJe7dnY0SCMEmzH6DzLj6JYMgIuFy9yjp47g0SPg=; b=o//Xbj7+SXaY7AarkFF+d06F3fbqL5KNroCH2YAZHFYduXGTM4eyACiyxvQc0w85OL aKUNqSCQZ+ASP3/xg23ljXzVTEzombw3m7jPhbYrF3+ma4P5wUFho6s7Db0gzaPoRwa1 DhKNKpKTaDVQy24/XBpMHNlO38Pk3icJQD1Gtf+Lur/rVNfeqWtaCB+Lk6qGnEwHZG/F EJvDGHvofOL6Vi9XX3XyDYEe2mJC9d07ADHx7EtvjHBH/lhfve4Qq/PwQ9kj53FQ/5jY BCcQOXmAH9+ByiJhtw60N3gklISQUkpdg8kkuZOgJmY3EdJADaARgIRr5pWcbaWnr+1e tleA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784348098; x=1784952898; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=kJkPJe7dnY0SCMEmzH6DzLj6JYMgIuFy9yjp47g0SPg=; b=F0TOmQ45ygrbi7eSGLAIxJ/XM3SRIkgBBWUSu8XyQU3YRH5AGy5pWdV6rhJe5npmPb Pr5Cd8eTFXvyuIMFEO5RKKA5QTsANAl0Qime1HLpPfgIZWzv0jfEIr2chlOh/pcwcvzw 8kYa1PWILnKgLuT8BedRjvOVc9TiwU6NMWiNC9JHqoC6bqSKc1XapPQ2Kx0nNh0wwq2O NDUEtaVE8Ab6SH7y9mPYs3KTLu2G8xZIBolkcImZ4FGzKeiOW7+4kLwESroM6ulD7BSq QZe3NwYvMAV+H2Glf5eo7YRmIqHnGabx+WhPMqmG7RnOmHB6woCSHEbku78olhamdOu1 vA9g== X-Forwarded-Encrypted: i=1; AHgh+RpShRMbv0xPcSaMXRvcD1pR1O2NGn/gZaB/hCjzx8IQ1dSVmD7bbO/fhqioT73UlaoEm/taBf27A36/6Ew=@vger.kernel.org X-Gm-Message-State: AOJu0YytIV5dPonRE5HJpRzRVX4gUGfHSSK/lWcrLnyElRB7K96MtrI7 bwHctkFPsDWdizSzQ6p3lkAkQbkG1YTLsx3xGWMQF/xtBkeIGaBKR8jG X-Gm-Gg: AfdE7cmu+h88wz0/kSPPgmsuVcqigtHxZHtTKgRtjmrkgrJ2lM6jnfxzRPFFlW7bES5 8e8ia6FLjCE1YycwN2yfe7tZ5IFWdRJCV9cfafarq4NMPkGuXroMZnodCO3z8xoK6PVjypwIih7 8E63/IDhB32woxjppt3J2WZPh/X/Yxm0ouXBnoJO7/nfRC6d7RCCroiIKaJqydsT8KHYijsqB7Y n/ONC1c3EH+uey+kplaL2QbPrYogwUvxsw0IocsZ54xfbwwtF4x+sC9av5ggzehbcqSwJ4sIY4F yUVBganTinnIv51L9LLxIumwhDqF4Ny1yJQHaURa6Wnb81WyjYp4mMxdTH25c1IbiMP2m13C8yb 1ChzkHRB0/w9haROnx+F92qtz44gjcGwj9fuyPTnscqpAuWTW5oSpItzYw0+mDLlMkm9Wg5AV1z 8MYt+u X-Received: by 2002:a17:903:1c8:b0:2be:3850:297e with SMTP id d9443c01a7336-2cf349bff53mr53301185ad.31.1784348097757; Fri, 17 Jul 2026 21:14:57 -0700 (PDT) Received: from [127.0.1.1] ([188.253.12.32]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf346daf66sm21346695ad.50.2026.07.17.21.14.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 21:14:57 -0700 (PDT) From: Jia Jia To: bvel, rtik, efwo, kodw, michael.christie@oracle.com Cc: slf@hdu.edu.cn, mst@redhat.com, jasowang@redhat.com, pbonzini@redhat.com, stefanha@redhat.com, eperezma@redhat.com, virtualization@lists.linux.dev, kvm@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] vhost-scsi: Prevent OOM from invalid protection SGL count Date: Sat, 18 Jul 2026 12:14:19 +0800 Message-Id: <20260718041420.1452333-1-physicalmtea@gmail.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <8f5b5350-0be9-4b79-a6c9-069d418dee30@oracle.com> References: <20260717142205.103515-1-physicalmtea@gmail.com> <8f5b5350-0be9-4b79-a6c9-069d418dee30@oracle.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Before sending my patch, I did a duplicate check against the upstream linux-next tree, upstream history, publicly searchable mailing-list archives, and Patchwork. I searched using the vhost-scsi and scatterlist function names, T10-PI, invalid protection SGL counts, and the OOM/resource-exhaustion symptoms. I did not find Linfeng's earlier patch. Could you please point me to Linfeng's patch, or confirm what the additional check covers? In particular, does it also validate: prot_bytes <= exp_data_len before subtracting prot_bytes from exp_data_len and entering the SGL mapping path? I had identified this as a related PI length-mismatch path, but did not include it in the patch I sent. With a one-byte combined payload and pi_bytesout=2, KGDB stopped at the following call stack: #0 sg_alloc_table_chained( table=0xffff88810bbc5108, nents=0, first_chunk=0xffff888110050000, nents_first_chunk=2048) at lib/sg_pool.c:117 #1 vhost_scsi_handle_vq+2295 #2 vhost worker task #3 srso_alias_return_thunk The stop was at the `BUG_ON(!nents)` instruction in `sg_alloc_table_chained()`, and the kernel log recorded `kernel BUG at lib/sg_pool.c:117!`. This confirms that the PI length check is needed before the iterator adjustment and SGL mapping path. If Linfeng's patch covers both the invalid protection SGL count and this PI length check, I will not submit duplicate work. Regarding the AI question: AI assistance was used during the source analysis and test development. I also checked the relevant code path and the host-side behavior.