vhost_scsi_complete_cmd_work() drops the virtqueue mutex before calling vhost_signal(). VHOST_SET_VRING_CALL replaces call_ctx.ctx and releases the old eventfd_ctx while holding the same mutex. vhost_signal() reads the call context before and after vhost_notify(), so a concurrent callfd update can make it signal a freed context or NULL. KASAN reported the use through: eventfd_signal_mask vhost_signal vhost_scsi_complete_cmd_work The context was released through: eventfd_ctx_put vhost_vring_ioctl vhost_scsi_ioctl Keep the mutex held through vhost_signal() so completion notification and callfd updates are serialized. Fixes: 057cbf49a1f0 ("tcm_vhost: Initial merge for vhost level target fabric driver") Link: https://lore.kernel.org/r/20260720085306.1519294-1-physicalmtea@gmail.com Signed-off-by: Jia Jia --- Changes since RFC: - Send as a non-RFC v2. - Add Fixes and Link tags. drivers/vhost/scsi.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 9a1253b9d8c5..7f46bc0de3c2 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -735,10 +735,9 @@ static void vhost_scsi_complete_cmd_work(struct vhost_work *work) vhost_scsi_release_cmd_res(se_cmd); } - mutex_unlock(&svq->vq.mutex); - if (signal) vhost_signal(&svq->vs->dev, &svq->vq); + mutex_unlock(&svq->vq.mutex); } static struct vhost_scsi_cmd * -- 2.34.1