[PATCH] xen/blkback: Prevent missed completion when draining I/O

[PATCH] xen/blkback: Prevent missed completion when draining I/O

[Gui-Dong Han]

xen_blk_drain_io() sets drain before checking inflight.
xen_blkbk_unmap_and_respond_callback() decrements inflight with
atomic_dec_and_test() before checking drain.

The pre-wait condition check was added to avoid missing a completion, but
atomic_set() is unordered. With one I/O in flight, the drain path can set
drain to 1 and read inflight as 1 before the completion decrement. The
completion path then decrements inflight to 0 but can still read drain as
0. It skips complete(), so the drain path waits until the timeout despite
no I/O remaining.

Add a full barrier between setting drain and reading inflight.
atomic_dec_and_test() already provides full ordering on the completion
side.

Fixes: 6927d92091df ("xen/blkback: Fix two races in the handling of barrier requests.")
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
---
Found by auditing atomic operations used for synchronization.
A similar fix can be found in 6df8e84aa6b5.
---
 drivers/block/xen-blkback/blkback.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 7871099bc0d4..88526e349ce1 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -1021,6 +1021,13 @@ static void xen_blk_drain_io(struct xen_blkif_ring *ring)
 	struct xen_blkif *blkif = ring->blkif;
 
 	atomic_set(&blkif->drain, 1);
+	/*
+	 * Publish drain before checking inflight. Otherwise,
+	 * xen_blkbk_unmap_and_respond_callback() can decrement inflight with
+	 * atomic_dec_and_test() and still see drain == 0 after this path saw
+	 * inflight > 0, missing the completion.
+	 */
+	smp_mb();
 	do {
 		if (atomic_read(&ring->inflight) == 0)
 			break;
-- 
2.34.1

Re: [PATCH] xen/blkback: Prevent missed completion when draining I/O

[Jan Beulich]

On 30.07.2026 10:40, Gui-Dong Han wrote:
> --- a/drivers/block/xen-blkback/blkback.c
> +++ b/drivers/block/xen-blkback/blkback.c
> @@ -1021,6 +1021,13 @@ static void xen_blk_drain_io(struct xen_blkif_ring *ring)
>  	struct xen_blkif *blkif = ring->blkif;
>  
>  	atomic_set(&blkif->drain, 1);
> +	/*
> +	 * Publish drain before checking inflight. Otherwise,
> +	 * xen_blkbk_unmap_and_respond_callback() can decrement inflight with
> +	 * atomic_dec_and_test() and still see drain == 0 after this path saw
> +	 * inflight > 0, missing the completion.
> +	 */
> +	smp_mb();
>  	do {
>  		if (atomic_read(&ring->inflight) == 0)
>  			break;

Yet then don't we also need a barrier in xen_blkbk_unmap_and_respond_callback()'s
check? Barriers almost always come in pairs, after all.

Jan

Re: [PATCH] xen/blkback: Prevent missed completion when draining I/O

[Gui-Dong Han]

On Thu, Jul 30, 2026 at 4:43 PM Jan Beulich <jbeulich@suse.com> wrote:
>
> On 30.07.2026 10:40, Gui-Dong Han wrote:
> > --- a/drivers/block/xen-blkback/blkback.c
> > +++ b/drivers/block/xen-blkback/blkback.c
> > @@ -1021,6 +1021,13 @@ static void xen_blk_drain_io(struct xen_blkif_ring *ring)
> >       struct xen_blkif *blkif = ring->blkif;
> >
> >       atomic_set(&blkif->drain, 1);
> > +     /*
> > +      * Publish drain before checking inflight. Otherwise,
> > +      * xen_blkbk_unmap_and_respond_callback() can decrement inflight with
> > +      * atomic_dec_and_test() and still see drain == 0 after this path saw
> > +      * inflight > 0, missing the completion.
> > +      */
> > +     smp_mb();
> >       do {
> >               if (atomic_read(&ring->inflight) == 0)
> >                       break;
>
> Yet then don't we also need a barrier in xen_blkbk_unmap_and_respond_callback()'s
> check? Barriers almost always come in pairs, after all.

The matching barrier is already provided by atomic_dec_and_test(), which
is fully ordered.  It orders the inflight decrement before the following
drain read.

Thus, an additional barrier in
xen_blkbk_unmap_and_respond_callback() would be redundant.

Thanks.