From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7FEE125F7A9 for ; Tue, 14 Jul 2026 13:17:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784035070; cv=none; b=kM9Ic3gQezHIap7S/BaFdvAvO+Jn90Zs5c6TcEadzBfiIahiV7s5MuadDp8FkCOwmoIGvQTcUnQtywDWcFwNv8KmFjfhbil2YoXBGlyJsE/wA6i9gCY7m1N1tNzIwlWac1G7HpWyinPzhHvvPTypXjsIZ5i02wmC/ebsG0FGPW4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784035070; c=relaxed/simple; bh=nlvh7CSMqUiIujUhp9BH2IdZPZMU6ylLQI28sV+2+ZA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=N1pVZV8fBvua9bixmI7+FZFe8pfsVLR6PwYiaIYpqTg/acb1DeHpoziEGnacvWeB2NNNczUON8k/QHFa/xjTl/T6hLM9vqcIf3A0ZXE+xvUiWnArSaC0XiiGNqZVdfRzytABJ6p1oSfHB8Li0LitVHx6OGriHE3AHIl2XADKlvM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=NwKx25gA; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=P81mEPO/; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="NwKx25gA"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="P81mEPO/" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784035067; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=+SO+5kDYlyBkSJf2vk/RjtSZDkaoll53kor2Z2ySV6U=; b=NwKx25gAFszJlKU6Ikii6dm+ddAttXedju+ASm2vrSyiwlXFv+MmirtC4smQcwF4qj+JNh 3WpgJcBNCg2PLnHYuulEerry6BB4xOxF0431w5IIm9Nijy9ek5iuJ4guvm4KM0u6ZrNO6R 5R1nieNaJpxm1UBeQttUV6QmAjy+JJw= Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-133-bRq8hfE_OOqzENnJYnI3Dg-1; Tue, 14 Jul 2026 09:17:46 -0400 X-MC-Unique: bRq8hfE_OOqzENnJYnI3Dg-1 X-Mimecast-MFC-AGG-ID: bRq8hfE_OOqzENnJYnI3Dg_1784035065 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-473f4a48e9aso2835871f8f.2 for ; Tue, 14 Jul 2026 06:17:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1784035065; x=1784639865; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=+SO+5kDYlyBkSJf2vk/RjtSZDkaoll53kor2Z2ySV6U=; b=P81mEPO/PdCj3Sd0rO+XhVJf5s5mkbpbLdbpt62dcXQ7B86rdKWt5H8+lhvwGOEsJn iIToiYDjKroemV9xOaKGMq/QV+K6iUA4swSH0FJCY5aP6ItD3MjhMLsYP7Tz2usc4rbJ fA6gxkiKFW2+U2/553W9HEihCobFIgGjMItWKtEE+7FdmksQB7I9mw9PmdOnj7su9sQd 15FMTb5d4BFQSj8NJQIXQxlLFj1u5Rptw2e7vZiSaUa/eKF6RwAaLwxdnyanP2x+8GNR j1StGqrMHOK5KFsqXMmWgDAcqFrqFNKHyVSvq1ycw2MgFHOM4t5QpouW0FS2oYSXf8Bu TEBw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784035065; x=1784639865; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=+SO+5kDYlyBkSJf2vk/RjtSZDkaoll53kor2Z2ySV6U=; b=kBXIpv8ER9q1+j21oWPfRjLutbjl0Qix8m3wZJkHaqAWyodaOcPEFAtBxqe6+EeMsc t5Ov74UEiYsWOP8ROruaf3PLSdqcl0ff1ZTTL0SGndD0ki8uA5Xf3XbB0jAKqi1FQv+x 5+/NGfGTa3JTkK9G0HhqkJB/8BtPeQciS0pkxo0RvcUTK+rJNA+qgUx24N1Z+9OQDFwB breP9CWbtFtFbHfr/5e3WSiZx4FuJOxVMfECgyM1SNtV4Yu98xph5dE1pRszp7oSSBAo lBVMJt99BOAe6h9ejIwKnEcd+flpwcwiZ7wwluXlQUBLc4dFl5C3iF93kM6XepeLo/4u bgfg== X-Forwarded-Encrypted: i=1; AHgh+Rq3oje+CPzeJORCHVTlz6lqZjxnCWL/sguHMhTPoDtdWbE8l8ir0++Nc3gjPiakB6Q8FioY6C3va7wWkZs=@vger.kernel.org X-Gm-Message-State: AOJu0YwB7MS57PoUrODvXjpwJB5bEH6wfdF/hBtb6HMtn9GnE6ElbE6l NHYcq/UC0XFQICvvZlN5S1/bWNZ2PCXmpx3ysW+b6tQzACBewfHNvysy0DS1yJcyPQW/7yvR8l+ AS2YIvEsEjQ+qNVDSP6iXFWbz2mklBUazZGCHkfQVG/9moXHv/w1A8vCkJX3H03ynbg== X-Gm-Gg: AfdE7ckxQOKfoOFlh37rl2PGgYNeOLdjR2MfsHysL1YvnLwnYBBRsRlSaZL8vI4LZts 6ytaLl5vX1A8jxYnxT/u2kv43/tnItX8tfAn9IavyTlyLPFvZWdhWDvq9JngRR2uvWQvnOr/Dmp 9vAJkrdkfBNeifgWuYArZxOwsJgbVVkelamPuv2z/wPPAP/5rPEeob1bA0JSux3wzksK7+hNgvF FyEocGS0m2HkPtt5tBQsjVx1dw+r/29MnUV1WrJ9nB8Njede0ruuxCr/kMTijuHNL5nY3tYD4Um 9NpDMs83aZT1e1gG0izbCm3yx2RH3NRP/rrcQzcKBFztnZ6Au6wb0bU6N6MWSL1WC2Gv7Dp7YIM ggZBQ/lpYX1F8PB4o8ltDrzqf2Gw1oA2Mxxk= X-Received: by 2002:a5d:5e07:0:b0:47e:81b1:74aa with SMTP id ffacd0b85a97d-47f488bdae4mr2796414f8f.42.1784035064503; Tue, 14 Jul 2026 06:17:44 -0700 (PDT) X-Received: by 2002:a5d:5e07:0:b0:47e:81b1:74aa with SMTP id ffacd0b85a97d-47f488bdae4mr2796364f8f.42.1784035063914; Tue, 14 Jul 2026 06:17:43 -0700 (PDT) Received: from redhat.com (IGLD-80-230-24-117.inter.net.il. [80.230.24.117]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f4634e029sm8851487f8f.3.2026.07.14.06.17.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 14 Jul 2026 06:17:43 -0700 (PDT) Date: Tue, 14 Jul 2026 09:17:40 -0400 From: "Michael S. Tsirkin" To: Jinqian Yang Cc: jasowang@redhat.com, xuanzhuo@linux.alibaba.com, eperezma@redhat.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, liuyonglong@huawei.com, wangzhou1@hisilicon.com, linuxarm@huawei.com Subject: Re: [PATCH] virtio_net: fix infinite loop in virtnet_poll_cleantx when device is broken Message-ID: <20260714091622-mutt-send-email-mst@kernel.org> References: <20260713132025.703147-1-yangjinqian1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260713132025.703147-1-yangjinqian1@huawei.com> On Mon, Jul 13, 2026 at 09:20:25PM +0800, Jinqian Yang wrote: > virtnet_poll_cleantx() contains a do-while loop that cleans up > transmitted TX buffers and calls virtqueue_enable_cb_delayed() to check > whether more buffers need processing. When the virtio backend stops > responding during guest reboot, used->idx is never updated, so > virtqueue_enable_cb_delayed() always returns false and the loop never > terminates. Then it will block reboot process, and the guest will hang. > > The problem occurs during guest reboot under network traffic: > > 1. kernel_restart() -> device_shutdown() traverses the device list > 2. virtio_dev_shutdown() calls virtio_break_device() which sets > vq->broken = true > 3. virtio_dev_shutdown() then calls virtio_synchronize_cbs() to wait > for in-flight callbacks to complete > 4. A virtio interrupt fires, softirq is deferred to ksoftirqd which > calls net_rx_action() -> virtnet_poll() -> virtnet_poll_cleantx() > 5. virtnet_poll_cleantx() enters the do-while loop and never exits > because the QEMU backend has stopped updating used->idx, despite > vq->broken having been set to true in step 2. > > Since the loop runs inside ksoftirqd (a SCHED_OTHER kthread), it is > visible to the scheduler and does not trigger a hard lockup. However, > the kthread never leaves the loop, so RCU detects it as a CPU stall > and reports it periodically. Meanwhile, the reboot process remains > blocked in device_shutdown() because virtio_dev_shutdown() cannot > complete its synchronization step, and the guest hangs permanently. > > This can be reproduced on a guest with a virtio-net device: run iperf3 > traffic in the guest, then trigger reboot. The reboot occasionally hangs > permanently with RCU stall on ksoftirqd. > > Observed on ARM64 KVM guest: > > CPU#1 RCU stall (ksoftirqd/1), repeated periodically: > virtqueue_enable_cb_delayed_split <- virtnet_poll <- __napi_poll <- > net_rx_action <- handle_softirqs <- run_ksoftirqd <- > smpboot_thread_fn <- kthread > > Fix by adding a virtqueue_is_broken() check to the loop condition, so > that the loop exits immediately when the device is broken, allowing > the device shutdown to proceed. > > Signed-off-by: Jinqian Yang I'd expect lots of drivers have this issue? Wouldn't it make more sense to check virtqueue_is_broken in virtqueue_enable_cb_delayed/virtqueue_enable_cb? This way it works for all drivers. > --- > drivers/net/virtio_net.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c > index 7d2eeb9b1226..c8d2d420c31d 100644 > --- a/drivers/net/virtio_net.c > +++ b/drivers/net/virtio_net.c > @@ -2970,7 +2970,8 @@ static void virtnet_poll_cleantx(struct receive_queue *rq, int budget) > do { > virtqueue_disable_cb(sq->vq); > free_old_xmit(sq, txq, !!budget); > - } while (unlikely(!virtqueue_enable_cb_delayed(sq->vq))); > + } while (!virtqueue_is_broken(sq->vq) && > + unlikely(!virtqueue_enable_cb_delayed(sq->vq))); > > if (sq->vq->num_free >= MAX_SKB_FRAGS + 2) > virtnet_tx_wake_queue(vi, sq); > -- > 2.33.0