From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 65F4430C14A for ; Thu, 16 Jul 2026 05:14:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784178875; cv=none; b=rSs+xrORQmMRErYCV3VIkMtCe/MRpsklIZOs3eGIsds2gwB3a7LrQUnACW9Uzch7z0h33mv20YHr+oaGSaWHtsNS6+rmIeCi22MwHBAB2zP4tI22QB5Qav7VySfCZlaMUJ5+OlFqaw+It6OVPHp534KFf8auAvCgQKju5YOTgLo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784178875; c=relaxed/simple; bh=2dv7Xp2yhNU1dw2G6/8qADYCMZeGeab7+y55mN9rsMs=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=pMmCXEoOd4LMqRZ++JAGcFnG5QxCO3FaFf8mBVPz2DlCieJDNInt0A0R3t+qM7l/QwYs+oXpPyrqRYDNdSRRimnFPCYOqO1UpzpO9Y1BtmTcbWHrld3peTu8vSYjRuUo7dsbYEndrsWxj4oJ8Msilp1LWoLE41XR9rsb9lunUu4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=h0g7whNQ; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=SLQHqKVT; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="h0g7whNQ"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="SLQHqKVT" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1784178873; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=YC1bxmvVJRWuz3ht/6dY0XwyFCC/YYtV/qcXCt5WC50=; b=h0g7whNQJY+HYiChe/shKdx0ZDDNr44+PGoBMecte5nEPXU3muct59mjO1PybCVRPISgtg mOYCUGr8Q1nydAtrmra1+4q8/5GsL7l7hlHvGKCctY9FPLZe9oyZm3cN/8x+U0jlKvPYT/ oT+1JaFgHge47xHMsL5TZqanKq8U5g4= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-551-B8psqNmHMeaLRnY7epZkPQ-1; Thu, 16 Jul 2026 01:14:31 -0400 X-MC-Unique: B8psqNmHMeaLRnY7epZkPQ-1 X-Mimecast-MFC-AGG-ID: B8psqNmHMeaLRnY7epZkPQ_1784178870 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-493bc2b376fso46410275e9.3 for ; Wed, 15 Jul 2026 22:14:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1784178870; x=1784783670; darn=vger.kernel.org; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=YC1bxmvVJRWuz3ht/6dY0XwyFCC/YYtV/qcXCt5WC50=; b=SLQHqKVTcXxfuY1zalbaK070/85UnYSodNC2+z/tyuwlRca+MQK0Lj3B/ltNUFDNiD NhgGN9yEbnYn2A0Qsr2dq5dnQEzzxIUSbDXpPhW/q+QN2/pc77EX/pB+gwvFsCa68mK1 NmETWXZ74L1usKbej8kUrqriJdz2faa4C+fGv1pedws1UxlNY6ShkbZVWa6LixFOwWxJ Db/8AvAna6dHVhxyoDFIm95cMsni4kck/Jp7bBd9fRB6f45o4D+tvd55zUNWhlv44Iub N316C+iKq84mo5mCLpOhx02U5vqQCmmFxbq2AHKr90yaa2OOu1P3/ChiwHOwz2dkX99z Rg2A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784178870; x=1784783670; h=in-reply-to:content-disposition:content-type:mime-version :references:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=YC1bxmvVJRWuz3ht/6dY0XwyFCC/YYtV/qcXCt5WC50=; b=fr+57Z8Wf4o7xsVBxeBTqTjKxybSuToPHyupEHdHJkJdKRJDcvtgYK0Zw3s5GZH+aS kQQ4/0feQxGOr/TpdJvN0NVGKUu1pjs1OboD1PEnXPM9pVBRaUL4J0LobQx06dEd1kA7 GUndS/aALUBiMIkd03ZlXY3flgu3B2TcynLYQfY8/D3Ar2B1BSr+oaN3xi/hs8kslCj4 d4K680anERJzSJNA68ybNnyVHgq0lptZNwqUNQRfonszYhodsXm6z/MjPNjSV0qsZmqv OMU5yjnGh0H4TXzteOxHM0Dyxx+9XUzD8igQFof0nNFK+hAx4q4P8oRC85hhHXVc4OAF 6q9g== X-Forwarded-Encrypted: i=1; AHgh+Rq0Ikie/luHDqZ0bUC3scPbV1QSFErGubo4uuj2Ny+6uvUyW8jVyjVTaMUy4HjOT38JCdQiDm1X5i0btP4=@vger.kernel.org X-Gm-Message-State: AOJu0YwlpNP259XWN4SOX+QqpnvILmNf0l2EJavjblj3Q9KVpy97hFwB hVIaWcFxc0zkNhb+/Pc7QBu+98ntucVaqIxuaSkVd56EsMdZ162ZAjlRwFjE/PpEQDuzC47R+cF 0jr46Tq6N5soW1rVX6utr70TY1awKRSvEi2NQVlJ0wMC7jGAP9QTEGRmK9VyOmjyO4A== X-Gm-Gg: AfdE7cnarrRGmZ+v24vRaI3qhAerLevWT+v8zErfwKMbrNX3A6nxlmnCIrAbhs5nXrM GXY0QH39yJIxUoUXt5fjXSOWPdHzWWKChPYMAmPI5cgtnYspugfI2Vrsp669MxQ5PEPFVDztjJ0 goAWd+JwUZ5vVw36dyvRKvHE5gSEc4PyBEks6n5yoBuU6O+brzpDc/aBdIfAi8E0L2eKaHhjxAz LAPT5n6O9ngrBMgCmasSjIH/N4xhN3NGWQzNZ8zAD7O7atJUvHeIlqTke1QUd8avy5MZ9PmmISj oxNl96KxcErqewGBTaQ7SezrbckOKYcADDD3PosF9oJSipFZEgdUuoOs+j4TjQ0+mYuHL4eNvDa 1C4nECEwg0bHDNPpr9H4AeNQl X-Received: by 2002:a05:600c:4ec8:b0:493:a435:d870 with SMTP id 5b1f17b1804b1-4953c286e00mr62234425e9.27.1784178870158; Wed, 15 Jul 2026 22:14:30 -0700 (PDT) X-Received: by 2002:a05:600c:4ec8:b0:493:a435:d870 with SMTP id 5b1f17b1804b1-4953c286e00mr62234295e9.27.1784178869707; Wed, 15 Jul 2026 22:14:29 -0700 (PDT) Received: from redhat.com (IGLD-80-230-24-117.inter.net.il. [80.230.24.117]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f464b7f84sm20560186f8f.27.2026.07.15.22.14.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 15 Jul 2026 22:14:29 -0700 (PDT) Date: Thu, 16 Jul 2026 01:14:25 -0400 From: "Michael S. Tsirkin" To: Jinqian Yang Cc: jasowang@redhat.com, xuanzhuo@linux.alibaba.com, eperezma@redhat.com, andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, netdev@vger.kernel.org, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, liuyonglong@huawei.com, wangzhou1@hisilicon.com, linuxarm@huawei.com Subject: Re: [PATCH v2] virtio_net: fix infinite loop in virtnet_poll_cleantx when device is broken Message-ID: <20260716011312-mutt-send-email-mst@kernel.org> References: <20260716035201.3736582-1-yangjinqian1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260716035201.3736582-1-yangjinqian1@huawei.com> On Thu, Jul 16, 2026 at 11:52:01AM +0800, Jinqian Yang wrote: > virtnet_poll_cleantx() contains a do-while loop that cleans up > transmitted TX buffers and calls virtqueue_enable_cb_delayed() to check > whether more buffers need processing. When the virtio backend stops > responding during guest reboot, used->idx is never updated, so > virtqueue_enable_cb_delayed() always returns false and the loop never > terminates. Then it will block reboot process, and the guest will hang. > > The problem occurs during guest reboot under network traffic: > > 1. kernel_restart() -> device_shutdown() traverses the device list > 2. virtio_dev_shutdown() calls virtio_break_device() which sets > vq->broken = true > 3. virtio_dev_shutdown() then calls virtio_synchronize_cbs() to wait > for in-flight callbacks to complete > 4. A virtio interrupt fires, softirq is deferred to ksoftirqd which > calls net_rx_action() -> virtnet_poll() -> virtnet_poll_cleantx() > 5. virtnet_poll_cleantx() enters the do-while loop and never exits > because the QEMU backend has stopped updating used->idx, despite > vq->broken having been set to true in step 2. > > Since the loop runs inside ksoftirqd (a SCHED_OTHER kthread), it is > visible to the scheduler and does not trigger a hard lockup. However, > the kthread never leaves the loop, so RCU detects it as a CPU stall > and reports it periodically. Meanwhile, the reboot process remains > blocked in device_shutdown() because virtio_dev_shutdown() cannot > complete its synchronization step, and the guest hangs permanently. > > This can be reproduced on a guest with a virtio-net device: run iperf3 > traffic in the guest, then trigger reboot. The reboot occasionally hangs > permanently with RCU stall on ksoftirqd. > > Observed on ARM64 KVM guest: > > CPU#1 RCU stall (ksoftirqd/1), repeated periodically: > virtqueue_enable_cb_delayed_split <- virtnet_poll <- __napi_poll <- > net_rx_action <- handle_softirqs <- run_ksoftirqd <- > smpboot_thread_fn <- kthread > > Fix by adding a virtqueue_is_broken() check to the loop condition, so > that the loop exits immediately when the device is broken, allowing > the device shutdown to proceed. > > Signed-off-by: Jinqian Yang Good thanks! Just the subject needs change so it's clear we are changing virtio core not virtio net. > --- > Changes in v2: > - Moved vq->broken check to virtqueue_enable_cb_delayed(). > > v1: https://lore.kernel.org/lkml/20260713132025.703147-1-yangjinqian1@huawei.com/ > --- > drivers/virtio/virtio_ring.c | 8 ++++++++ > 1 file changed, 8 insertions(+) > > diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c > index b438dc2ce1b8..5c169fbb418a 100644 > --- a/drivers/virtio/virtio_ring.c > +++ b/drivers/virtio/virtio_ring.c > @@ -3233,6 +3233,14 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_vq) > { > struct vring_virtqueue *vq = to_vvq(_vq); > > + /* > + * When the device is broken there is no point in polling used->idx, > + * the backend will never update it. Return true to let callers > + * exit their cleanup loops instead of spinning forever. > + */ > + if (unlikely(vq->broken)) > + return true; > + > if (vq->event_triggered) > data_race(vq->event_triggered = false); > > -- > 2.33.0