[GIT PULL] vhost,virtio,vdpa: bugfixes

[GIT PULL] vhost,virtio,vdpa: bugfixes

[Michael S. Tsirkin]

The following changes since commit 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4:

  Linux 7.4-rc1 (2026-11-01 13:26:31 -0800)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus

for you to fetch changes up to 1a577f9402c1780cc1e663f48d5dd54c02051b09:

  virtio_pci: don't take the MSI mutex under cpu_hotplug_lock (2026-11-03 07:32:14 -0500)

----------------------------------------------------------------
vhost,virtio,vdpa: bugfixes

Just a bunch of fixes all over the place.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

----------------------------------------------------------------
Dudu Lu (1):
      vhost/vringh: Fix IOTLB permission in putu16_iotlb()

Eugenio Pérez (1):
      MAINTAINERS: add missing virtio/vdpa/vduse/vhost headers

Fang Xieyan (4):
      vringh: bound top-level re-entry into indirect tables
      vringh: add regression test for cyclic indirect descriptor
      vringh: reject empty / undersized indirect descriptor tables
      vhost: fix used ring index wrap in vhost_add_used_n_in_order

Jia Jia (5):
      vhost-scsi: preserve event ordering
      vhost-scsi: do not relock event vq mutex on send_evt fallback
      vduse: avoid infinite loop when no affinity CPU is online
      vhost-scsi: do not count PI bytes in the data length
      vhost-scsi: fix page reference leak in misaligned I/O fallback

Karl Mehltretter (1):
      virtio-spi: Fix virtio_spi_config kernel-doc

Li RongQing (1):
      virtio_ring: reset IN_ORDER state in virtqueue_init()

Linfeng Sun (8):
      vdpa_sim: serialize IOTLB updates with dataplane access
      vdpa: invalidate DMA mappings before releasing memory
      vhost: fix dirty logging for in-order used ring entries
      vhost: reject invalid IOTLB update permissions
      vhost-scsi: validate event queue descriptor direction
      vhost-scsi: reject delayed virtqueue setup
      vhost: reject backend enable without a kick file
      vhost-vdpa: initialize state before publishing cdev

Maoxia (1):
      virtio_pci: add missing newline to the pmcsr error message

Mingbing Zhai (1):
      virtio_balloon: initialize wakeup_lock before virtqueues are set up

Sergii Ushakov (1):
      virtio-blk: clamp max_segments to virtqueue ring size

Shubham Antil (1):
      vhost-scsi: zero misaligned I/O bounce pages

Tal Zussman (2):
      vhost-vdpa: fix pinned page leak in vhost_vdpa_pa_map() error path
      vhost-vdpa: unpin mappings by range

Thorsten Blum (1):
      hwrng: virtio - prevent use-after-free after a failed restore

Wei-Shuo Chen (1):
      virtio: use consistent virtqueue terminology

Xiang Mei (1):
      vdpa: fix double free of the reply skb in vdpa_nl_cmd_dev_config_get_doit()

Yu Zhang (1):
      vhost-vdpa: drop the parent's vq callback before the call fd is released

Yuho Choi (3):
      virtio_blk: Reset device on probe error paths after DRIVER_OK
      iommu/virtio: Reset device before deleting virtqueues on probe failure
      vdpa/snet: Don't discard the DPU error in snet_send_ctrl_msg()

Zenghui Yu (Huawei) (1):
      virtio_pci: don't take the MSI mutex under cpu_hotplug_lock

chenglong.ma (1):
      vduse: fix VA/PA confusion in the coherent page fault path

sungbyeongchan (1):
      virtio_ring: use shadow flags when detaching split descriptors

zhang jiao (1):
      virtio_ring: Initialize id field in packed indirect descriptors

 MAINTAINERS                          |   4 ++
 drivers/block/virtio_blk.c           |  45 +++++++++++++-
 drivers/char/hw_random/virtio-rng.c  |   7 +++
 drivers/iommu/virtio-iommu.c         |   6 +-
 drivers/vdpa/mlx5/net/mlx5_vnet.c    |  10 ++-
 drivers/vdpa/solidrun/snet_ctrl.c    |   3 +-
 drivers/vdpa/vdpa.c                  |   7 ++-
 drivers/vdpa/vdpa_sim/vdpa_sim.c     |   7 +++
 drivers/vdpa/vdpa_user/iova_domain.c |  11 +++-
 drivers/vdpa/vdpa_user/vduse_dev.c   |  15 +++--
 drivers/vhost/scsi.c                 |  68 +++++++++++++++++----
 drivers/vhost/test.c                 |   4 ++
 drivers/vhost/vdpa.c                 | 115 ++++++++++++++++++++++++-----------
 drivers/vhost/vhost.c                |  36 ++++++++---
 drivers/vhost/vringh.c               |  29 ++++-----
 drivers/virtio/virtio_balloon.c      |   3 +-
 drivers/virtio/virtio_mmio.c         |   2 +-
 drivers/virtio/virtio_pci_common.c   |  12 +++-
 drivers/virtio/virtio_pci_common.h   |   5 +-
 drivers/virtio/virtio_ring.c         |  13 +++-
 include/uapi/linux/virtio_spi.h      |   2 +-
 tools/virtio/vringh_test.c           |  41 +++++++++++++
 22 files changed, 347 insertions(+), 98 deletions(-)

Re: [GIT PULL] vhost,virtio,vdpa: bugfixes

[Paul Moses]

On Thu, Mar 12, 2026 at 06:56:40AM +0000, Paul Moses wrote:
> > On Wed, Mar 11, 2026 at 08:00:45PM -0400, Michael S. Tsirkin wrote:
> > > On Wed, Mar 11, 2026 at 02:12:17PM +0000, Paul Moses wrote:
> > > > >
> > > > > Indeed, seems legit, thanks!
> > > > >
> > > > > The only thing is that I dislike two error handling paths here.
> > > > > So I wonder why isn't this as simple as fixing the double free
> > > > > directly:
> > > > >
> > > >
> > > > That works for me, should I send it out?
> > > >
> > > > Thanks,
> > > > Paul
> > >
> > >
> > > Please do.
> > >
> > > Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> >
> > Oh and I forgot
> >
> > Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
> >
> >
> > >
> > > --
> > > MST
> >
> >
>
> Considering that this pattern has occurred in multiple independent source files,
> maybe it is worth it to make intent more clear? What about this?
>
> >From c3b9431dc736cec60c0b288b13d9fa718341f46a Mon Sep 17 00:00:00 2001
> From: Paul Moses <p@1g4.org>
> Date: Tue, 10 Mar 2026 15:23:58 -0500
> Subject: [PATCH] vdpa: don't free reply skb after genlmsg_reply()
>
> genlmsg_reply() hands the reply skb to netlink, and
> netlink_unicast() consumes it on all return paths, whether the
> skb is queued successfully or freed on an error path.
>
> vdpa_nl_cmd_dev_config_get_doit() currently jumps to nlmsg_free(msg)
> after genlmsg_reply() fails, which can hit the same skb twice.
>
> Return the genlmsg_reply() error directly and keep nlmsg_free()
> only for pre-reply failures.
>
> Fixes: ad69dd0bf26b ("vdpa: Introduce query of device config layout")
> Cc: stable@vger.kernel.org
>
> Signed-off-by: Paul Moses <p@1g4.org>

I like crediting people for their work.  Let's do this. Pls post as a
proper patch starting a new thread, so all 0day tooling catches this,
and I'll apply. I'll then apply a rework removing the duplication, on
top.  Thanks!


> ---
>  drivers/vdpa/vdpa.c | 12 ++++++++----
>  1 file changed, 8 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/vdpa/vdpa.c b/drivers/vdpa/vdpa.c
> index 34874beb0152e..702d3a7772219 100644
> --- a/drivers/vdpa/vdpa.c
> +++ b/drivers/vdpa/vdpa.c
> @@ -1352,15 +1352,19 @@ static int vdpa_nl_cmd_dev_config_get_doit(struct sk_buff *skb, struct genl_info
>  	}
>  	err = vdpa_dev_config_fill(vdev, msg, info->snd_portid, info->snd_seq,
>  				   0, info->extack);
> -	if (!err)
> -		err = genlmsg_reply(msg, info);
> +	if (err)
> +		goto mdev_err;
> +
> +	put_device(dev);
> +	up_read(&vdpa_dev_lock);
> +
> +	return genlmsg_reply(msg, info);
>
>  mdev_err:
>  	put_device(dev);
>  dev_err:
>  	up_read(&vdpa_dev_lock);
> -	if (err)
> -		nlmsg_free(msg);
> +	nlmsg_free(msg);
>  	return err;
>  }
>
> --
> 2.53.GIT
>


It's obvious now your intention was always to diminish my 
contribution. This really only reflects negatively on you.

You or claude didn't even disassemble it. It's slop. My
patch is objectively superior both in human readability
and performance.

[GIT PULL] vhost,virtio,vdpa: bugfixes

[Michael S. Tsirkin]

The following changes since commit 136057256686de39cc3a07c2e39ef6bc43003ff6:

  Linux 5.16-rc2 (2021-11-21 13:47:39 -0800)

are available in the Git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus

for you to fetch changes up to bb93ce4b150dde79f58e34103cbd1fe829796649:

  vdpa_sim: avoid putting an uninitialized iova_domain (2021-11-24 19:00:29 -0500)

----------------------------------------------------------------
vhost,virtio,vdpa: bugfixes

Misc fixes all over the place.

Revert of virtio used length validation series: the approach taken does
not seem to work, breaking too many guests in the process. We'll need to
do length validation using some other approach.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

----------------------------------------------------------------
Longpeng (1):
      vdpa_sim: avoid putting an uninitialized iova_domain

Michael S. Tsirkin (4):
      Revert "virtio-scsi: don't let virtio core to validate used buffer length"
      Revert "virtio-blk: don't let virtio core to validate used length"
      Revert "virtio-net: don't let virtio core to validate used length"
      Revert "virtio_ring: validate used buffer length"

Stefano Garzarella (2):
      vhost/vsock: fix incorrect used length reported to the guest
      vhost/vsock: cleanup removing `len` variable

Wu Zongyong (1):
      vhost-vdpa: clean irqs before reseting vdpa device

Ye Guojin (1):
      virtio-blk: modify the value type of num in virtio_queue_rq()

 drivers/block/virtio_blk.c       |  3 +-
 drivers/net/virtio_net.c         |  1 -
 drivers/scsi/virtio_scsi.c       |  1 -
 drivers/vdpa/vdpa_sim/vdpa_sim.c |  7 +++--
 drivers/vhost/vdpa.c             |  2 +-
 drivers/vhost/vsock.c            |  8 ++----
 drivers/virtio/virtio_ring.c     | 60 ----------------------------------------
 include/linux/virtio.h           |  2 --
 8 files changed, 9 insertions(+), 75 deletions(-)

Re: [GIT PULL] vhost,virtio,vdpa: bugfixes

[pr-tracker-bot]

The pull request you sent on Sun, 28 Nov 2021 12:58:03 -0500:

> https://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost.git tags/for_linus

has been merged into torvalds/linux.git:
https://git.kernel.org/torvalds/c/d06c942efea40e1701ade200477a7449008d9f24

Thank you!

-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/prtracker.html