Commit 22598f55a4c2 for kernel

commit 22598f55a4c2b510b3df5e69e563387a963222ae
Author: Jia Jia <physicalmtea@gmail.com>
Date:   Fri Jul 24 14:09:19 2026 +0800

    vhost-scsi: flush backend after device ioctls

    vhost-scsi translates guest response descriptors into userspace iovecs
    when commands are submitted.  Target-core completes those commands
    asynchronously, so VHOST_SET_MEM_TABLE can replace the memory table while
    an in-flight command still retains response iovecs translated through the
    old table.

    If the old mapping is reused after VHOST_SET_MEM_TABLE returns, command
    completion can write the response to an unrelated userspace object.

    Flush the vhost-scsi backend after vhost_dev_ioctl() handles a device
    ioctl.  This waits for in-flight commands that can still use the old
    response iovecs before the ioctl returns.

    Signed-off-by: Jia Jia <physicalmtea@gmail.com>
    Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
    Message-ID: <20260724060919.1569170-1-physicalmtea@gmail.com>

diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c
index c79197edb163..aae1164e1ca9 100644
--- a/drivers/vhost/scsi.c
+++ b/drivers/vhost/scsi.c
@@ -2434,9 +2434,10 @@ vhost_scsi_ioctl(struct file *f,
 	default:
 		mutex_lock(&vs->dev.mutex);
 		r = vhost_dev_ioctl(&vs->dev, ioctl, argp);
-		/* TODO: flush backend after dev ioctl. */
 		if (r == -ENOIOCTLCMD)
 			r = vhost_vring_ioctl(&vs->dev, ioctl, argp);
+		else
+			vhost_scsi_flush(vs);
 		mutex_unlock(&vs->dev.mutex);
 		return r;
 	}