From nobody Mon Aug 24 10:11:08 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1785797155; cv=none; d=zohomail.com; s=zohoarc; b=aLalpk0ygKunDXGW4AfXpO9KY2oUmXzNYe/yw/TJ7KpFy8bpFBMMdOAc6inse82trqGEiXyzmlTtRVsFqD3rxrzmywmXpau9e18UpNob1xzsCVxYsThiZ/NBM3rXRGmePxj7cVj49JTEE2Et06xKFFNyP31ucP8aRIl1rwo4clg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785797155; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=pK99277ZRIB+F3LySItCEjYQAHjcaVfqLnt6i3fHIM0=; b=WTPEdTl9ypDD5u0FZltwY3s20Sq3XEK6UZbGqzJdbmzvuWvFNZH2AhpeGArpySLN7ER7r/6R3o5J6gMey16ZVHVxK0BasARrF6USGyqYFC9MKxK25q1bWxnt8FAwFCHxNtBmZFhkq5jlgO70KfCCKa3QPWEpLX8pHedhaPOHCV4= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 178579715584851.749543956343246; Mon, 3 Aug 2026 15:45:55 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wr1P0-00057N-EJ; Mon, 03 Aug 2026 18:44:58 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wr1Oz-000570-CQ; Mon, 03 Aug 2026 18:44:57 -0400 Received: from fhigh-a7-smtp.messagingengine.com ([103.168.172.158]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wr1Oy-00056Q-2R; Mon, 03 Aug 2026 18:44:57 -0400 Received: from phl-compute-01.internal (phl-compute-01.internal [10.202.2.41]) by mailfhigh.phl.internal (Postfix) with ESMTP id AD1BB1400144; Mon, 3 Aug 2026 18:44:54 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-01.internal (MEProxy); Mon, 03 Aug 2026 18:44:54 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 3 Aug 2026 18:44:48 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=irrelevant.dk; h=cc:cc:content-transfer-encoding:content-type:date:date:from :from:in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1785797094; x= 1785883494; bh=pK99277ZRIB+F3LySItCEjYQAHjcaVfqLnt6i3fHIM0=; b=H CCw9G4ubb+BvQGn8OS5Bj0/qEaUkvZqLKcgqiLTdh3wYNNSEEQQjATgHJmUmyhus IwQ7Avzj5u/M/q2Or2laD6EqDMTzrCl0Ds4ef58jydFeGBmigzQ0Nw2oSteb47/o MiLfssTkt+vNg672ZMD/I6ZzSqRhLkXIBNzYZ5GwFjPBnOwdWDg8RHUS7f4Tnqsr DBwYszcJdMKmZe0DpaSdcB6AThkPTXUGAur+riHG550DfL6zi8JPrlZQifmb6D2M jCgqTDaT3hi/LcG5A7+Uw6I1pGnpckKhOcj8Y7XQU6z9WN6VlLN/Ie29o59nNjdl ZtmluyHjlIlefQMizObHg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1785797094; x=1785883494; bh=p K99277ZRIB+F3LySItCEjYQAHjcaVfqLnt6i3fHIM0=; b=itOVSJRSGIoksn2Ad FawTHAe07TSC8018TJDkUc5/p5kLOhS3elspYM3KrbU73FQdrzCh2iOyXgSoFSfX X8IjonJtc18TEBzenZTHXeJuKsqaEtS3wUp30TnqpqgW2EQFoWMQmQ3mZsaloKCJ MkwgotbMj0fp/HEjF5768sem2nYVVMTMFkW+lJqXGaSKBf+FBHcROYSy0WdIpU0z Hj5KWi3x/hyELUQdUcAnRvLvBp4hw42bCNBqqejLCOdhMKy24bAEMQhPyfM20L4J NykkUpdah0b5KV3g/Jv6HI5ecYFLQNKulT5UwqZekMv2JRDtvxLjiNMnuLnx7Uzp AXkuA== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTFeYi8b03TbMhsFw7/oxx/QrEVsMwlPi+oaba5QCP69t8QrgketamvRj8WkFvrAR+ DZnowf3ijlnjgkMrNhPwzyJf+CeU/gVrhoMStZ3AeNquyEbKN1pd8OaBik9dfnStlbPiGl bEzo4w3pwxmzoCU4GhOSut/DC3EUTMVoH4IhsBWVontBvwLinUs91fRMicF74mGHxFXg/d mzyD6vlH4ENWopYcfYB78XmcHQfQKeIdVMRV9ecSdz4hwu1DEpIgZ2VL4UqdEJth9+GSKg Q8GcssenJ51ghx5TAvOH20mB8nWpuYquKBpGUyPGkY3sm6c/PGBw0dMerxRoJLHCL9qQR8 uFJiqkNV/slhRzr9VIXU67SY45fACjGaOFKyzLm+smphc3/sDjTnohfqYPg9tmGaJtex5N 5XV85Hp1uSi3Yu4AbY1DSeZQHMUEy9t1zTNVJGMQsskU+Dv2j999bztw7HgnlK3QTXmpiN 41YBXadN++OXJ4vtKBFzasUadxWSNOd/QiIfsoqkirTjfHccz4igmgCBNmEX8cAXe32WDO Y3MjhX51BM1APG+6wGAayptHIrxQxVy3RtoilBKQXO8HoalfCgjd1nVU49l4Xy7+mM2vfw mU9UZDF5jlCTiLyrDYfe3Yihpk79i6Y1MeB8FsGwj65wG0Gj+ZVFbXDAgQjQ X-ME-Proxy: Feedback-ID: idc91472f:Fastmail From: Klaus Jensen To: qemu-devel@nongnu.org Cc: Peter Maydell , Minwoo Im , qemu-stable@nongnu.org, Minwoo Im , Klaus Jensen , Keith Busch , Klaus Jensen , Jesper Devantier , qemu-block@nongnu.org Subject: [PULL 1/4] hw/nvme: drop AER requests without aiocb in nvme_del_sq() Date: Mon, 3 Aug 2026 15:44:32 -0700 Message-ID: <20260803224436.38768-2-its@irrelevant.dk> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260803224436.38768-1-its@irrelevant.dk> References: <20260803224436.38768-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=103.168.172.158; envelope-from=its@irrelevant.dk; helo=fhigh-a7-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @irrelevant.dk) X-ZM-MESSAGEID: 1785797156576158500 Content-Type: text/plain; charset="utf-8" From: Minwoo Im nvme_del_sq() asserted r->aiocb was always set when canceling a queue's inflight requests. A pending Async Event Request has no aiocb (nvme_aer() parks it without issuing any block I/O), so deleting a queue with an outstanding AER trips the assert instead of just dropping the request. Cc: qemu-stable@nongnu.org Signed-off-by: Minwoo Im Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index bd6ad64b2000..e3eadf3d1dd0 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -4862,12 +4862,14 @@ static uint16_t nvme_del_sq(NvmeCtrl *n, NvmeReques= t *req) sq =3D n->sq[qid]; while (!QTAILQ_EMPTY(&sq->out_req_list)) { r =3D QTAILQ_FIRST(&sq->out_req_list); - assert(r->aiocb); r->status =3D NVME_CMD_ABORT_SQ_DEL; - blk_aio_cancel(r->aiocb); - } =20 - assert(QTAILQ_EMPTY(&sq->out_req_list)); + if (r->aiocb) { + blk_aio_cancel(r->aiocb); + } else { + QTAILQ_REMOVE(&sq->out_req_list, r, entry); + } + } =20 if (!nvme_check_cqid(n, sq->cqid)) { cq =3D n->cq[sq->cqid]; --=20 2.53.0 From nobody Mon Aug 24 10:11:08 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1785797161; cv=none; d=zohomail.com; s=zohoarc; b=EEcwImC9Sxa5nG9cIbHnEcd0/VN4ISRXIzAEZ/RoDeCadISQo8U2jT0tXTsjh7juN+IcP6XyVO+ojqvQBuy6LvqMaIyXsSPb8oDxK2x9wxF2+G4OeZzLKbrGvwgyF2c4+LHGpM3MvsuqY8f0iw5NlWAlwWtI08DP4blusD6sifg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785797161; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=Fexyhnzj/u9gD63iqTRm7949vPST9u199nO6W6D81do=; b=Cr8sWE7WdwN1yRBM+N0hwK+6zPrZhFaDpJL3uKpL+GCl1F79lka/VWHgR7W1BLyQPVD1sNu3F+z3qF+8JXRZZ0GxXbuFjv+v2mX61FcZ830pNlggEay23xVFMAi4PLhMN7NqGkf6QzSlkdCVDEMAjGNIuOACVuGx0WtK2kWXlYc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785797160494834.9847452844812; Mon, 3 Aug 2026 15:46:00 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wr1P8-0005Ao-7v; Mon, 03 Aug 2026 18:45:06 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wr1P5-00058y-VD; Mon, 03 Aug 2026 18:45:04 -0400 Received: from fhigh-a7-smtp.messagingengine.com ([103.168.172.158]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wr1P4-00056n-Gr; Mon, 03 Aug 2026 18:45:03 -0400 Received: from phl-compute-01.internal (phl-compute-01.internal [10.202.2.41]) by mailfhigh.phl.internal (Postfix) with ESMTP id 604011400149; Mon, 3 Aug 2026 18:45:00 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-01.internal (MEProxy); Mon, 03 Aug 2026 18:45:00 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 3 Aug 2026 18:44:55 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=irrelevant.dk; h=cc:cc:content-transfer-encoding:content-type:date:date:from :from:in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1785797100; x= 1785883500; bh=Fexyhnzj/u9gD63iqTRm7949vPST9u199nO6W6D81do=; b=u ngDhISJpYXUzS2MPuKMV/ytFI+SsW8/k7PFz3XHcO+mqp0nlJGkhNX9b91MTzyNp BZxJjGGWuD6r3A57+fIlnAJjVBygleW/7TFblY1v6Awfs7AHCypQuh1W/sO+9fYu CDNBay64e0usKQEh+O86V+SgE9AZt+E1r/7XQiOP6RInteFEztl/gsWes2xJsnUO sdLcI+zJdMXJ1DcxjNx0wxPCgdzvvvR5/uCk2S/s4XDj25Q3KY6mmZlFyy10ZIWw y4nyydVzg63MOKtuxcd4is8aFh8ymEsa1r8G2SdiocUfJSmgjE8/7nlQY1NPpHX2 W7Uafr+m/k5Wf1jeRiPRg== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1785797100; x=1785883500; bh=F exyhnzj/u9gD63iqTRm7949vPST9u199nO6W6D81do=; b=k7v0IiungaMZ7/rDS Ex/wkYUEcGXEjDeumBqTsz568lnDajcVxK1HSpiLzNddOkbslYbMIfRgFpQuCo2+ JCfsPOyjLbjGWXoTcZGHaX1W8vgFoeXcecwFQ2EqC49447qJNm+sxaDSK/8A7eqK uf96gLI8nMaV0xxAJeUDusxrAYwJ4IUFV57q9h5TxWtDBQfFMQc6fjZIQmV4aZeL joCF+Sd87eswRLG25pa61nDIUsqbPrsCWphWipQKnCm8ysWIBjIotEO8Yetw4Uyp FWhLIc5vlTRj2WJBaDv5h681ypVV/LpokXtPDgtjjeLmH3aX5esPu0J4jhs6VoPE TtBeQ== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTGBwBi/Yeu/peMq8Ngc1wQNqPR0owGT6TsXi5P//CvcIH3VpbZD6k72frfNrTPmJ1 HzAsw0Nek94AFz6/hyId/n2vFnSsULLz/dCExBxAVF7Wkns8SSKeussPL693jItbJPhw8W 9NppZ+VdrXsTJGGeIhQeFbTsRWyq6tXwlEwPv3OovYpL6WbYzUeIGapD881h3iwBuhQzBL yggvH+NPIaYLOPLKtGfICRUCi/Zgm1F30tHBJPANJnYoIv44XJEtXG1AV01WR8YvxuSn6v uVaspQ8TgNHfAnkT968W4FZr2dNYnNGf8Y/bmzegupv3TawcKvMGnuXBPLbFA9djhX2mAB g68EkAKlwOiCbPuEu7uQn9EIrPTBsSsHOdqLqddS4yczrdS3P79U2mjwSaqN+r6RgY1KYP sZ8fndK7W7CTCDw9mrN/sagsE8DHP41/Q0d7aLW0cMhtOF6Kbj04NhC3tzj/cbVHQ966R0 w1sau87+PQmY/hBLflMsZuT9EjNmYX1B/l08IulRHxkNKYhNImxSdvB+HjpnqBld2VrhE0 k4n2U66uOM+Irquz4tmDawTWBgi33JLwVEqtoKH0gc4WQ6I4vQHPFpOe5exssyTJwLY1H0 Wh7DLTNqU0lD3xPpjCEn/QCoI0ZjeewHfQwe0ULRnrc//eVAjCwZeCFRMCqA X-ME-Proxy: Feedback-ID: idc91472f:Fastmail From: Klaus Jensen To: qemu-devel@nongnu.org Cc: Peter Maydell , Minwoo Im , qemu-stable@nongnu.org, Minwoo Im , Klaus Jensen , Keith Busch , Klaus Jensen , Jesper Devantier , qemu-block@nongnu.org Subject: [PULL 2/4] hw/nvme: factor out nvme_sq_cancel_inflight() Date: Mon, 3 Aug 2026 15:44:33 -0700 Message-ID: <20260803224436.38768-3-its@irrelevant.dk> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260803224436.38768-1-its@irrelevant.dk> References: <20260803224436.38768-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=103.168.172.158; envelope-from=its@irrelevant.dk; helo=fhigh-a7-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @irrelevant.dk) X-ZM-MESSAGEID: 1785797162961158500 Content-Type: text/plain; charset="utf-8" From: Minwoo Im Factor the cancel-and-wait loop used by nvme_del_sq() into nvme_sq_cancel_inflight(), so it can be reused to drain queues on controller reset. Cc: qemu-stable@nongnu.org Signed-off-by: Minwoo Im Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 31 +++++++++++++++++++++---------- 1 file changed, 21 insertions(+), 10 deletions(-) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index e3eadf3d1dd0..e355c256a561 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -4826,6 +4826,26 @@ static int nvme_init_sq_ioeventfd(NvmeSQueue *sq) return 0; } =20 +/* + * A pending Async Event Request has no aiocb (nvme_aer() parks it without + * issuing any block I/O), so there is nothing to cancel; just drop it. + */ +static void nvme_sq_cancel_inflight(NvmeSQueue *sq, uint16_t status) +{ + NvmeRequest *r; + + while (!QTAILQ_EMPTY(&sq->out_req_list)) { + r =3D QTAILQ_FIRST(&sq->out_req_list); + r->status =3D status; + + if (r->aiocb) { + blk_aio_cancel(r->aiocb); + } else { + QTAILQ_REMOVE(&sq->out_req_list, r, entry); + } + } +} + static void nvme_free_sq(NvmeSQueue *sq, NvmeCtrl *n) { uint16_t offset =3D sq->sqid << 3; @@ -4860,16 +4880,7 @@ static uint16_t nvme_del_sq(NvmeCtrl *n, NvmeRequest= *req) trace_pci_nvme_del_sq(qid); =20 sq =3D n->sq[qid]; - while (!QTAILQ_EMPTY(&sq->out_req_list)) { - r =3D QTAILQ_FIRST(&sq->out_req_list); - r->status =3D NVME_CMD_ABORT_SQ_DEL; - - if (r->aiocb) { - blk_aio_cancel(r->aiocb); - } else { - QTAILQ_REMOVE(&sq->out_req_list, r, entry); - } - } + nvme_sq_cancel_inflight(sq, NVME_CMD_ABORT_SQ_DEL); =20 if (!nvme_check_cqid(n, sq->cqid)) { cq =3D n->cq[sq->cqid]; --=20 2.53.0 From nobody Mon Aug 24 10:11:08 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1785797188; cv=none; d=zohomail.com; s=zohoarc; b=CfdNNTfmnZWapvndNOV5XnskwmO0uHV7Vxdaj8PkHxW3eM9jlTBxiyC7sxADP1MRK7jzDK1YTJeX/cl96jMQLZqN5iqDNjj4znD+saLo165GL0hcsBitDf2UdzrCRvBzTkbp/xrY6OmOeM+TLt29mCg540T73F4XhLH/70Aclh4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785797188; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=tswvNfYH4AJpc79MQDqgtGTxdPbU+FUqD4Y4hrIGJL4=; b=eGD5YEEcKDT1tPoZSS1zqvpgA9uKgeWqzFj4o8ZYa3oReojuigKbJZCedWCvLj+lOB0ixme9tur4vfQlzcGeVVXlZTqiwmqCe7ftMTki5pCq2iEGryxpInyvUgmIFvvwc/U8s4y81tFu1b2QcO8mnqfF8SYPtna58tTcyfvYEcs= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 17857971882358.635669701649022; Mon, 3 Aug 2026 15:46:28 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wr1PD-0005Iy-C6; Mon, 03 Aug 2026 18:45:11 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wr1PB-0005Dm-8Z; Mon, 03 Aug 2026 18:45:09 -0400 Received: from fout-a4-smtp.messagingengine.com ([103.168.172.147]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wr1P9-00057b-7W; Mon, 03 Aug 2026 18:45:09 -0400 Received: from phl-compute-01.internal (phl-compute-01.internal [10.202.2.41]) by mailfout.phl.internal (Postfix) with ESMTP id 1EB81EC00F8; Mon, 3 Aug 2026 18:45:06 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-01.internal (MEProxy); Mon, 03 Aug 2026 18:45:06 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 3 Aug 2026 18:45:00 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=irrelevant.dk; h=cc:cc:content-transfer-encoding:content-type:date:date:from :from:in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1785797106; x= 1785883506; bh=tswvNfYH4AJpc79MQDqgtGTxdPbU+FUqD4Y4hrIGJL4=; b=l YYx0wbNMTJWIqtMJwNy1MMwgv2GKz3VVOC5aH/QBnyilIrkqlrUvZVjXyLzq+ErW UmA2YTOT+RTU9nhLumhKDICpWfuPRKiU8UGyCs1pYgW4yx4fdXZCMEmgHSry9g8f gNdefImoHN3MGTqdUHNZbGBXKCrahqYN4THRCczBJJElOmaQPVu6sc/pHCRxTWPm qUyV5ZNFAm3MyFvQBiYdtILnEigT6dsJq32VIrSUk1sIVuPG+V4bQaFgTW70pUfG cisnFI+ckurYatZKhh106CHd6nKOyODvO9rnZL6mPNjveg8lhuZjB0KxO6CLzmy8 RsYO3txjHQ6s3xCqgEonA== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1785797106; x=1785883506; bh=t swvNfYH4AJpc79MQDqgtGTxdPbU+FUqD4Y4hrIGJL4=; b=GMq+B4/kZ2RIGrtek WKa4IsF098dxSwnej440x99yetDZJmRW9lAOs0YWZqffAwupgiIoKQIaUn8OGCwZ zVaAB3bCRm/wLuDg9lSP8vLHGcztrX3F63+knQ+eDOczh48CcJNwN4t0QnWTUIce w6+89xbuAOK/7jL5Fom8Q0toHqAOZRdUF9FZgMRlZgOnOsS55LxAKCTyeFeiAJCF j2uyGR/7D9Nq7L1MPN/tnmr3WTwM1jikEmnIHny6emmvz/ddFgpG/+Ol8rrpK9AO ClGaHcdWjei8N5ccmmjmmXWzKafZ0qsOyUWs8ImP7YMwvN0Qnhw49UbAPVvzhuAu 3IQMg== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTFtqVo6kF7gYj7UH29WRVRgnHsa7j0SPqjL6nyeOfplmNT/oInijOEL4gWZBU35KZ jNX/Hnnpa35lzSHSRuXuiR5/snxpi+qMrooSjWr3bYdtlh7Gaw2Uwpm5PcVs8lI/E/bgXU Wi4CKrXL9QDJBC5DeUYID3tGKXnBSi4DDno05kypn/P0z890IYpJstjUn2OBGmUx7dqFgQ R/HPPULFJC8odpjYvicCQSMuGH5a/A6XYvWSlk3f1tJSPi1u1+69IxnXIhts38fZYE6R/q 36A+hKxCkaEl1KlFs/ftxXbbOERXSMsfg4hXj3xCjKssQgU4qslE9xgGpwIjoBvt0HjZds sxWZBOtE03IqUQpaolaJaMTskwW7a6SgHws+R/r8Kzf4yqi29VM4cDk0zrDPizk2/h4oeR JtdKIT5GFmq2xgx5UgqDnU+FkUTZsm9Ra2XgspXTJBtx1Z72uFLYRzYs63DMmDztAwjYDp Tu+1i8qWjig4sWAE3ob5IlOeqO2eg6m7ybqleysffaI7llcShM+MH2MkgSaahavR+VHyrn WL9sccUy/MfXTd2r1RKXmkRCK3bEyjpvC+0PXGkBr7cMEptqJV7rsXKoeNpquokGoQU8b1 buAiiqQRD7qAjcnRiuNPFiwcr92wHaPZkJtGOayO6fSo65fm5xBlApyaZ3tA X-ME-Proxy: Feedback-ID: idc91472f:Fastmail From: Klaus Jensen To: qemu-devel@nongnu.org Cc: Peter Maydell , Minwoo Im , qemu-stable@nongnu.org, Minwoo Im , Klaus Jensen , Keith Busch , Klaus Jensen , Jesper Devantier , qemu-block@nongnu.org Subject: [PULL 3/4] hw/nvme: cancel inflight requests on controller reset Date: Mon, 3 Aug 2026 15:44:34 -0700 Message-ID: <20260803224436.38768-4-its@irrelevant.dk> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260803224436.38768-1-its@irrelevant.dk> References: <20260803224436.38768-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=103.168.172.147; envelope-from=its@irrelevant.dk; helo=fout-a4-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @irrelevant.dk) X-ZM-MESSAGEID: 1785797191120158500 Content-Type: text/plain; charset="utf-8" From: Minwoo Im nvme_ctrl_reset() freed every SQ/CQ right after nvme_ns_drain(), which only waits out requests on a per-namespace BlockBackend. That is safe as long as the guest first tore down I/O queues gracefully (Delete I/O SQ/CQ), since nvme_del_sq() already cancels and waits for anything left on a queue before freeing it. A reset that happens without that graceful sequence first (e.g. an abrupt/asynchronous controller reset) can still have commands inflight on blk_aio_*. Freeing sq/cq before those complete leaves their completion callbacks (nvme_rw_cb() and friends) to run against already-freed NvmeRequest/NvmeSQueue/NvmeCQueue memory via nvme_enqueue_req_completion(), causing a use-after-free/segfault. Run nvme_sq_cancel_inflight() over every queue in nvme_ctrl_reset() before the free loops, so no in-flight blk_aio_* callback can fire after sq/cq memory is freed. Cc: qemu-stable@nongnu.org Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3398 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/3883 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4068 Resolves: https://gitlab.com/qemu-project/qemu/-/work_items/4072 Signed-off-by: Minwoo Im Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index e355c256a561..8461b6fbdeae 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -8040,6 +8040,18 @@ static void nvme_ctrl_reset(NvmeCtrl *n, NvmeResetTy= pe rst) nvme_ns_drain(ns); } =20 + /* + * Cancel and wait out every inflight command on every queue first. A + * reset is not required to be preceded by the guest's graceful + * Delete I/O SQ/CQ sequence, so sq/cq must not be freed below while a + * blk_aio_* completion for them could still be in flight. + */ + for (i =3D 0; i < n->num_queues; i++) { + if (n->sq[i] !=3D NULL) { + nvme_sq_cancel_inflight(n->sq[i], NVME_CMD_ABORT_SQ_DEL); + } + } + for (i =3D 0; i < n->num_queues; i++) { if (n->sq[i] !=3D NULL) { nvme_free_sq(n->sq[i], n); --=20 2.53.0 From nobody Mon Aug 24 10:11:08 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org ARC-Seal: i=1; a=rsa-sha256; t=1785797152; cv=none; d=zohomail.com; s=zohoarc; b=RMmRJvGZchjCy8J38aH2jHA/WDqI2rsPVULtEthmeq8INfCthve2mZlWqhBvDBr8ypNdZm+hMb2kCuG0XkLjcLPJ8h5KRC2ecq/LyCXLjzZPw940LU5yeBLZWYwt8b+eEKYvhcCrdPw/Ku6Rxi1DtwWARe9xRmidkGPHugi0+KM= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1785797152; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:Subject:To:To:Message-Id:Reply-To; bh=08Dw4PPoAm/LKsvgv8DbTs0HZilaul6ArOzGW8pFwwE=; b=GO4i7ueJVByd9gqX3mewSQTi+z3qPMQdmk3YJky4PETB1Z4CSL55K4LBfgK2SporcMHllJDOmyq4UMevjxGvB0bOCrkF2hTvGCLJXfx/HUMjJ4elgHXqVKkIZKaui3aSRYgJ7BizjfSccqdO1w70jHdsYLhU4wFGUko+ekpgKvI= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org Return-Path: Received: from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1785797152145510.8341400179055; Mon, 3 Aug 2026 15:45:52 -0700 (PDT) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists1p.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1wr1PH-0005Jw-BQ; Mon, 03 Aug 2026 18:45:15 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wr1PF-0005JV-HJ; Mon, 03 Aug 2026 18:45:13 -0400 Received: from fout-a4-smtp.messagingengine.com ([103.168.172.147]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1wr1PE-00058a-1y; Mon, 03 Aug 2026 18:45:13 -0400 Received: from phl-compute-05.internal (phl-compute-05.internal [10.202.2.45]) by mailfout.phl.internal (Postfix) with ESMTP id E25D1EC00F8; Mon, 3 Aug 2026 18:45:10 -0400 (EDT) Received: from phl-frontend-03 ([10.202.2.162]) by phl-compute-05.internal (MEProxy); Mon, 03 Aug 2026 18:45:10 -0400 Received: by mail.messagingengine.com (Postfix) with ESMTPA; Mon, 3 Aug 2026 18:45:06 -0400 (EDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=irrelevant.dk; h=cc:cc:content-transfer-encoding:content-type:date:date:from :from:in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to; s=fm2; t=1785797110; x= 1785883510; bh=08Dw4PPoAm/LKsvgv8DbTs0HZilaul6ArOzGW8pFwwE=; b=E YLZll+ckbpiGVViNhqlq14zLgns9jiXlONBMFlHi1Wg/FOvuxax7hwffDnz2FQdT 6psPKgy8HqHOG0aWXNIuixouTIbZats7RplwTND/4Xxq31+QJbPG7WSFdY8om4sS DbIZbILX42bvnpEt1WhTVbuxIgkXjX573qFqlpPKbQAv8nT++3SMNpn8AXIk+njG NdOj0U2uVn9IQzLaw04zQWbyVsCFKzhjV8AY8clIEkCnX9s2iQEbIgj77azouw+m cS+bcLZMycTmTSn0MkzDmS327Rbvkz31Ktwcsv4aC93IOkPcEQ9fQ8VLlQ8TgieJ 34b15flpnOAy9V4VjDfow== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:date:date:feedback-id:feedback-id:from:from :in-reply-to:in-reply-to:message-id:mime-version:references :reply-to:subject:subject:to:to:x-me-proxy:x-me-sender :x-me-sender:x-sasl-enc; s=fm3; t=1785797110; x=1785883510; bh=0 8Dw4PPoAm/LKsvgv8DbTs0HZilaul6ArOzGW8pFwwE=; b=O4KXZz+jdhJtjQQkd ZkuKdSetK9EYsl3M7hS7hchUdG+OorC85BQCwM75X1lqiDhad0azhPjKe6qcysIz i+zJj4Vu8dYXmKRfWD6zeOZJfWpPzm+uaXl7yBTgTkE/xCe0UgE4BDAIsSVuQ/kZ zxvTWTSlopWWgrQqOG6GUF4lf3zFqiD37CFNkR5XVIwzDABS9YAflxkF5A1/eKRY UN+kg6bfJr1hZAHPSBdt+ZMuUv2wekNKt3LR41NWHJzAGi//gC4FX92Ob9KTi9q6 DaX986kM/l+oXafGakOi0ZLRfby852Kd7CkD9UYaWfzYk7erhUepNEnhZuu23AFY lCCQw== X-ME-Sender: X-ME-Received: X-ME-Proxy-Cause: dmFkZTFXkk6770ximeuBos74vR2JiBpZatXZdclZlrPAvXrkA2heiaORyn0hnKWjHIRFWz VbtxK/TPD3OPlr90XHwHeI5GUrlhvgfz4Lvo6r65by747p5uA18KRjwtDjikUtoj3P+0nB lq6xDGx6w7uwP2bGW43bVFZ1cGeRRCGDZ0al+jx8IF34pWJZQBEy2DAXQABe3WZODjLjaj n6FUTjfBkCgWWQ3B0dzUuYP3vgstYOAUo2y11UOwsS2R1/vVRd5ZlDgahgbEv1vO9/EWR4 tVOm7v0luKRlwrMs97altgzlqVKEuvuMELDl/BKSIuu0iy+KbUSanj1oojsLt9GxB8iCh5 ARMd0Pj6B3dNtEq/yIqYrZkfjAfFlKZknfUs16Mhnq9nJ39xWy+jd2jhiYqRiCvcgEF1Jg IrmxWb+Mk8Bjx/kjoVV8oR+FCokqa1SQaIeDlt3fbsyPbYdz1TjGba/2rQ4JPACmcb6klI 4a6KvAzq+4htm3dN5i0RBR/0JQ/bQwNtR1ijtXBlZOIkTNC/vOGuB1FEj9KiK9JjUrnS0i F5vzSZTr+NpgvdApBtu5WDCNxkcXQmNxMw9npAJ7J85YhmBuOnjqKPtCwjYc84t6SWs4Pz WVb3P3gjt4BjlhfLWaiEx+cAW2WYOo6EhaGwPUvPGtdPtt/vg9r9NIsfIxqg X-ME-Proxy: Feedback-ID: idc91472f:Fastmail From: Klaus Jensen To: qemu-devel@nongnu.org Cc: Peter Maydell , Klaus Jensen , qemu-stable@nongnu.org, Jesper Wendel Devantier , Keith Busch , Klaus Jensen , qemu-block@nongnu.org Subject: [PULL 4/4] hw/nvme: fix leak on copy ranges Date: Mon, 3 Aug 2026 15:44:35 -0700 Message-ID: <20260803224436.38768-5-its@irrelevant.dk> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260803224436.38768-1-its@irrelevant.dk> References: <20260803224436.38768-1-its@irrelevant.dk> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists1p.gnu.org; Received-SPF: pass client-ip=103.168.172.147; envelope-from=its@irrelevant.dk; helo=fout-a4-smtp.messagingengine.com X-Spam_score_int: -27 X-Spam_score: -2.8 X-Spam_bar: -- X-Spam_report: (-2.8 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: qemu development List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: qemu-devel-bounces+importer=patchew.org@nongnu.org X-ZohoMail-DKIM: pass (identity @irrelevant.dk) X-ZM-MESSAGEID: 1785797155225158500 Content-Type: text/plain; charset="utf-8" From: Klaus Jensen The buffer holding the ranges for the copy command is not correctly deallocated. Fix this. Cc: qemu-stable@nongnu.org Link: https://gitlab.com/qemu-project/qemu/-/work_items/4072 Fixes: 796d20681d9b ("hw/nvme: reimplement the copy command to allow aio ca= ncellation") Reviewed-by: Jesper Wendel Devantier Signed-off-by: Klaus Jensen --- hw/nvme/ctrl.c | 1 + 1 file changed, 1 insertion(+) diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c index 8461b6fbdeae..4893cf7e7418 100644 --- a/hw/nvme/ctrl.c +++ b/hw/nvme/ctrl.c @@ -2811,6 +2811,7 @@ static void nvme_copy_done(NvmeCopyAIOCB *iocb) =20 qemu_iovec_destroy(&iocb->iov); g_free(iocb->bounce); + g_free(iocb->ranges); =20 if (iocb->ret < 0) { block_acct_failed(stats, &iocb->acct.read); --=20 2.53.0