From nobody Sun Feb 8 03:27:29 2026 Received: from sender4-pp-f112.zoho.com (sender4-pp-f112.zoho.com [136.143.188.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9EA7E2D5A16 for ; Thu, 25 Dec 2025 04:29:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.112 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766636996; cv=pass; b=VC4kNDTrIt0PJhC2gWhPEukRaMwM0mOaz6eLxu5boau1F9s3pBXTrDtnoGApR9dBGhiLz3Dw6ylckixqSc2NaWZpfdC7HdThfo8igwqG56DKQX92qZDLAKpl0gc+Dks33N9X5JK8UI6nW1FgpAFr0rXTq+7YGppVOnCS8/z8YTc= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766636996; c=relaxed/simple; bh=5DNOxpsAuuOrylW+rjO2emqxL1JAJ5YvHZehrTPmfWw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=sv+or0pIcMZT6F6Dr1/C836D4xeA0/lM88MyfK2/TwtMo7wliXgPNvzADOlFy7zRbm4YLn0EFqanRi3CCgbVWyPUTc73zPb+Ka+Dgh5UNXbL08lywMtUrPhM5YpMwkH3kTQMemQPAZXY/ccre19NFGsIQBSNWkBxZxCOL1def18= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=eT48T/IP; arc=pass smtp.client-ip=136.143.188.112 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="eT48T/IP" ARC-Seal: i=1; a=rsa-sha256; t=1766636968; cv=none; d=zohomail.com; s=zohoarc; b=QGzK6rTVlGVBmAL1xIYXVhwM8bp63qVb2yBCtek7+5TLV1eROE4G8+CpXyO1ndurKY5tHFpHV4a0uOT7EbCtzOEpUQ9cAwyWDjCa1P85Tj8J/ejpchh9F/JOUi88hGkeprc29d+y0k/MglujGULxL3yk3l5gsco6kWq5dtuDCLU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1766636968; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=mfOi8qOrh2g3wFJTwUHxWZlTMKGv7eV+gj42v7SqpqM=; b=f6Tsr/oEw0hwimwfx9j5ZtKkIO8frhtVGCJ1O7lmjvlcu4uD3XzeMKW70mCYHkuPA1CjYS2pvXkm3iiK44K8bbv0VXanY42FlMkjX5iJKAVGbxhJ75UeBjGsvU8Q/CUdBZElNdXN288Ejwtq8wuNUTq0huxu/viA0QGnGc7iRAM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1766636968; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=mfOi8qOrh2g3wFJTwUHxWZlTMKGv7eV+gj42v7SqpqM=; b=eT48T/IPHV1Ft10ujX9/GKyMxZl1CB7wtnN9zmAdEDDfD8z/sTGbpOC8ZpQOjeSh mfur08LNmEf2P+jfl/A3226gjGHGeR3BK80OJEiEm9VaNdPJU41GML7EfopRrKwX9a6 hGuXi9yxlLOmdWP0IQxJbeQfP0VulUd/qygPvcgc= Received: by mx.zohomail.com with SMTPS id 1766636965454524.6090032100158; Wed, 24 Dec 2025 20:29:25 -0800 (PST) From: Li Chen To: Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , Pankaj Gupta , nvdimm@lists.linux.dev, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org Cc: Li Chen Subject: [PATCH V2 1/5] nvdimm: virtio_pmem: always wake -ENOSPC waiters Date: Thu, 25 Dec 2025 12:29:09 +0800 Message-ID: <20251225042915.334117-2-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251225042915.334117-1-me@linux.beauty> References: <20251225042915.334117-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" virtio_pmem_host_ack() reclaims virtqueue descriptors with virtqueue_get_buf(). The -ENOSPC waiter wakeup is tied to completing the returned token. If token completion is skipped for any reason, reclaimed descriptors may not wake a waiter and the submitter may sleep forever waiting for a free slot. Always wake one -ENOSPC waiter for each virtqueue completion before touching the returned token. Use READ_ONCE()/WRITE_ONCE() for the wait_event() flags (done and wq_buf_avail). They are observed by waiters without pmem_lock, so make the accesses explicit single loads/stores and avoid compiler reordering/caching across the wait/wake paths. Signed-off-by: Li Chen --- drivers/nvdimm/nd_virtio.c | 35 +++++++++++++++++++++-------------- 1 file changed, 21 insertions(+), 14 deletions(-) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index c3f07be4aa22..6f9890361d0b 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -9,26 +9,33 @@ #include "virtio_pmem.h" #include "nd.h" =20 +static void virtio_pmem_wake_one_waiter(struct virtio_pmem *vpmem) +{ + struct virtio_pmem_request *req_buf; + + if (list_empty(&vpmem->req_list)) + return; + + req_buf =3D list_first_entry(&vpmem->req_list, + struct virtio_pmem_request, list); + list_del_init(&req_buf->list); + WRITE_ONCE(req_buf->wq_buf_avail, true); + wake_up(&req_buf->wq_buf); +} + /* The interrupt handler */ void virtio_pmem_host_ack(struct virtqueue *vq) { struct virtio_pmem *vpmem =3D vq->vdev->priv; - struct virtio_pmem_request *req_data, *req_buf; + struct virtio_pmem_request *req_data; unsigned long flags; unsigned int len; =20 spin_lock_irqsave(&vpmem->pmem_lock, flags); while ((req_data =3D virtqueue_get_buf(vq, &len)) !=3D NULL) { - req_data->done =3D true; + virtio_pmem_wake_one_waiter(vpmem); + WRITE_ONCE(req_data->done, true); wake_up(&req_data->host_acked); - - if (!list_empty(&vpmem->req_list)) { - req_buf =3D list_first_entry(&vpmem->req_list, - struct virtio_pmem_request, list); - req_buf->wq_buf_avail =3D true; - wake_up(&req_buf->wq_buf); - list_del(&req_buf->list); - } } spin_unlock_irqrestore(&vpmem->pmem_lock, flags); } @@ -58,7 +65,7 @@ static int virtio_pmem_flush(struct nd_region *nd_region) if (!req_data) return -ENOMEM; =20 - req_data->done =3D false; + WRITE_ONCE(req_data->done, false); init_waitqueue_head(&req_data->host_acked); init_waitqueue_head(&req_data->wq_buf); INIT_LIST_HEAD(&req_data->list); @@ -79,12 +86,12 @@ static int virtio_pmem_flush(struct nd_region *nd_regio= n) GFP_ATOMIC)) =3D=3D -ENOSPC) { =20 dev_info(&vdev->dev, "failed to send command to virtio pmem device, no f= ree slots in the virtqueue\n"); - req_data->wq_buf_avail =3D false; + WRITE_ONCE(req_data->wq_buf_avail, false); list_add_tail(&req_data->list, &vpmem->req_list); spin_unlock_irqrestore(&vpmem->pmem_lock, flags); =20 /* A host response results in "host_ack" getting called */ - wait_event(req_data->wq_buf, req_data->wq_buf_avail); + wait_event(req_data->wq_buf, READ_ONCE(req_data->wq_buf_avail)); spin_lock_irqsave(&vpmem->pmem_lock, flags); } err1 =3D virtqueue_kick(vpmem->req_vq); @@ -98,7 +105,7 @@ static int virtio_pmem_flush(struct nd_region *nd_region) err =3D -EIO; } else { /* A host response results in "host_ack" getting called */ - wait_event(req_data->host_acked, req_data->done); + wait_event(req_data->host_acked, READ_ONCE(req_data->done)); err =3D le32_to_cpu(req_data->resp.ret); } =20 --=20 2.52.0 From nobody Sun Feb 8 03:27:29 2026 Received: from sender4-pp-f112.zoho.com (sender4-pp-f112.zoho.com [136.143.188.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 28C612D321D for ; Thu, 25 Dec 2025 04:30:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.112 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766637003; cv=pass; b=YigpseXFHHUpsjfX6T9yvdegxvY+juEUBDEi/Yo+QUNtoA7jFnD2XSkZyvQL4v86PXnyFaZEy2j1lfOKLjNo3HBBahKVAvnwILlp0eiAPSjAqRazI3c07ZKLy2EDhJoP6sT7cNV2OswlN/OyE/jvZWxsbcCeayWFO4Ye/pP/uJQ= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766637003; c=relaxed/simple; bh=P7MdJrrOweqn+awN5ug7drafrvynl+/CgZtltePDdFI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=B6Z8ODLIfWdpZVlgZ3FjPLE34noKro7JR8KN4Soz3CQuJioQxGORxRKvum7mzORu1y5HPwnmkozES2Iu0EVRC2vJ9XK3mOL1Q+QSrzlMyqfsby1gaBxndOpZzoj9Cozhn7EXr8Wl9OY1+sT9qRYyPFuAbakCTXNdAVxZ5n1Ecb4= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=QTI+362i; arc=pass smtp.client-ip=136.143.188.112 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="QTI+362i" ARC-Seal: i=1; a=rsa-sha256; t=1766636972; cv=none; d=zohomail.com; s=zohoarc; b=J6WJzH9fC/Rhq9iwZqhjkDwou/5eIn62zpYQhWo2EqtZ5Ugct7SkpeUftGaKIkE0Sr9X/dSh8K1HX20AjMnIdQx0Fuz/TJ0anvqfOi925tME9c9rd5AOYTE29zV/SmivIeD23qCCKf8szSxjnJtXam0SuE9zoF+OzosypVL1EBg= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1766636972; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=dSJUTum9tVwhRmP/n1Q+8mhg+IIQiW1CAyU6SlA3Qis=; b=YwcIeCi5STz6QmCSHQaKn9MQrQKkVx0mVCY/K1FAC5ieorjhJG2yPsKILUYJSi7giFUK1lUD08Lw9vVBh36MQoEzeSSwmcSDsVecZd97Fd8b+G+HgxUMXq+EfZRbG9KItd7ZCxOu7LmIT9xFO3X+2f7ne/6TpwU4DBldc3WRYjY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1766636972; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=dSJUTum9tVwhRmP/n1Q+8mhg+IIQiW1CAyU6SlA3Qis=; b=QTI+362iv/AdSJC8G8EsYF1arleNFgZOFT+Yn+HGw8Hmw9EsCfC78x0QitRnc/Dh Qb2R0EWJ0CaY1hplJqIn4l93T/Bmnb0kRoH0W+04NWW5e12/32WzVAu3JXbYJNxZ4yN 7R5pTZqMQPGDt7tCMJ06UNd5O5Tb+wXiL4DeNImE= Received: by mx.zohomail.com with SMTPS id 1766636969354450.8212224344853; Wed, 24 Dec 2025 20:29:29 -0800 (PST) From: Li Chen To: Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , Pankaj Gupta , nvdimm@lists.linux.dev, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org Cc: Li Chen Subject: [PATCH V2 2/5] nvdimm: virtio_pmem: refcount requests for token lifetime Date: Thu, 25 Dec 2025 12:29:10 +0800 Message-ID: <20251225042915.334117-3-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251225042915.334117-1-me@linux.beauty> References: <20251225042915.334117-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" KASAN reports a slab use-after-free from virtio_pmem_host_ack(). It happens when it wakes a request that has already been freed by the submitter. This happens when the request token is still reachable via the virtqueue, but virtio_pmem_flush() returns and frees it. Fix the token lifetime by refcounting struct virtio_pmem_request. virtio_pmem_flush() holds a submitter reference, and the virtqueue holds an extra reference once the request is queued. The completion path drops the virtqueue reference, and the submitter drops its reference before returning. Signed-off-by: Li Chen --- drivers/nvdimm/nd_virtio.c | 34 +++++++++++++++++++++++++++++----- drivers/nvdimm/virtio_pmem.h | 2 ++ 2 files changed, 31 insertions(+), 5 deletions(-) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index 6f9890361d0b..d0385d4646f2 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -9,6 +9,14 @@ #include "virtio_pmem.h" #include "nd.h" =20 +static void virtio_pmem_req_release(struct kref *kref) +{ + struct virtio_pmem_request *req; + + req =3D container_of(kref, struct virtio_pmem_request, kref); + kfree(req); +} + static void virtio_pmem_wake_one_waiter(struct virtio_pmem *vpmem) { struct virtio_pmem_request *req_buf; @@ -36,6 +44,7 @@ void virtio_pmem_host_ack(struct virtqueue *vq) virtio_pmem_wake_one_waiter(vpmem); WRITE_ONCE(req_data->done, true); wake_up(&req_data->host_acked); + kref_put(&req_data->kref, virtio_pmem_req_release); } spin_unlock_irqrestore(&vpmem->pmem_lock, flags); } @@ -65,6 +74,7 @@ static int virtio_pmem_flush(struct nd_region *nd_region) if (!req_data) return -ENOMEM; =20 + kref_init(&req_data->kref); WRITE_ONCE(req_data->done, false); init_waitqueue_head(&req_data->host_acked); init_waitqueue_head(&req_data->wq_buf); @@ -82,10 +92,23 @@ static int virtio_pmem_flush(struct nd_region *nd_regio= n) * to req_list and wait for host_ack to wake us up when free * slots are available. */ - while ((err =3D virtqueue_add_sgs(vpmem->req_vq, sgs, 1, 1, req_data, - GFP_ATOMIC)) =3D=3D -ENOSPC) { - - dev_info(&vdev->dev, "failed to send command to virtio pmem device, no f= ree slots in the virtqueue\n"); + for (;;) { + err =3D virtqueue_add_sgs(vpmem->req_vq, sgs, 1, 1, req_data, + GFP_ATOMIC); + if (!err) { + /* + * Take the virtqueue reference while @pmem_lock is + * held so completion cannot run concurrently. + */ + kref_get(&req_data->kref); + break; + } + + if (err !=3D -ENOSPC) + break; + + dev_info_ratelimited(&vdev->dev, + "failed to send command to virtio pmem device, no free slots in t= he virtqueue\n"); WRITE_ONCE(req_data->wq_buf_avail, false); list_add_tail(&req_data->list, &vpmem->req_list); spin_unlock_irqrestore(&vpmem->pmem_lock, flags); @@ -94,6 +117,7 @@ static int virtio_pmem_flush(struct nd_region *nd_region) wait_event(req_data->wq_buf, READ_ONCE(req_data->wq_buf_avail)); spin_lock_irqsave(&vpmem->pmem_lock, flags); } + err1 =3D virtqueue_kick(vpmem->req_vq); spin_unlock_irqrestore(&vpmem->pmem_lock, flags); /* @@ -109,7 +133,7 @@ static int virtio_pmem_flush(struct nd_region *nd_regio= n) err =3D le32_to_cpu(req_data->resp.ret); } =20 - kfree(req_data); + kref_put(&req_data->kref, virtio_pmem_req_release); return err; }; =20 diff --git a/drivers/nvdimm/virtio_pmem.h b/drivers/nvdimm/virtio_pmem.h index 0dddefe594c4..fc8f613f8f28 100644 --- a/drivers/nvdimm/virtio_pmem.h +++ b/drivers/nvdimm/virtio_pmem.h @@ -12,10 +12,12 @@ =20 #include #include +#include #include #include =20 struct virtio_pmem_request { + struct kref kref; struct virtio_pmem_req req; struct virtio_pmem_resp resp; =20 --=20 2.52.0 From nobody Sun Feb 8 03:27:29 2026 Received: from sender4-pp-f112.zoho.com (sender4-pp-f112.zoho.com [136.143.188.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 437FF2D7DD3 for ; Thu, 25 Dec 2025 04:30:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.112 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766637012; cv=pass; b=imjGUfH+0achW2EPdz7PqZbpjIyrssvPeTQGRQUpPL/yfjbObsjTbLdHNgTEI5bO9mQze6XA0w73WlQOvYeHd6cg/78aD0PdyhHP5KQIqdLTtdW1bIB6pfKgXOagPQbk/u/IcUGmqhWtIZgPn4jKU1uSm2DlI3lixKqCojO4YIA= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766637012; c=relaxed/simple; bh=NKvd/+tYecCEMrXxwsKIas9vAt6h21VhWvobet9on7w=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=e/DZUGwLpLYzmWbWNBj22z6aY/qP0ly4DRc/jP9UhRj8w0VlwCpUwPoCZxCZI2TMZ3UDtVLfIeP6ggMZznEYID1Nj4Q5EnVG1ykPPX1vpK5RTddYARA6eEajNxNF7gozz/ZaoYHRd6tcDs1XYpv1yk2WQ3J9vH16alf51U+1/fg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=tI4f+PHX; arc=pass smtp.client-ip=136.143.188.112 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="tI4f+PHX" ARC-Seal: i=1; a=rsa-sha256; t=1766636978; cv=none; d=zohomail.com; s=zohoarc; b=mj/658IHAciprjVc8eFLBFi/mWEl/Ax6XC0jLmgGtazLG5NbbVJI5YVKtPlVcbTHH58sv16sDJzYS08xC8s7NZwpY/oij0RQC6QUPrUQXPmMsamW0od36fmj/46AviInCSzr6IH4FuilTvt4r/QiW3dDuWcSoRKhoE2Ay8assIw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1766636978; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=kJF4gdUrN1RWIspzsiP0AMfYxj80Tonv1/R4T+fQ7FQ=; b=RZZlCOaCo3d31wFP+8nhe3UeX9qVBe67nUb1mz8U/3DbSCuHuTs+UlHGBX8WrsiTL47vd/qo2HuStuNz2u71c7/mfa7fWAg0tOK/zPXZd98hIQIJ0epap3GExp2MLkQ5ghNavQVmE7rFuzjnb70Z/xeRlKY9ud1FJZi2U9p55N0= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1766636978; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=kJF4gdUrN1RWIspzsiP0AMfYxj80Tonv1/R4T+fQ7FQ=; b=tI4f+PHXbw4EXh1juDoLwlv/oQZiDFrKQJuP69hPcJunYDXWfqfWTNAKaHhLflZ5 B7/KQJRs1nWjYfF3ZCMEHTlzK7/cwvHa+wEGTksfvimLUITcUVUi8/feU7OVhTwDkqZ DbbPezdkKEYj1oUnT8mykXL4Z/WimzDu7KwCghDk= Received: by mx.zohomail.com with SMTPS id 1766636977078588.3208836388319; Wed, 24 Dec 2025 20:29:37 -0800 (PST) From: Li Chen To: Pankaj Gupta , Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , virtualization@lists.linux.dev, nvdimm@lists.linux.dev, linux-kernel@vger.kernel.org Cc: Li Chen Subject: [PATCH V2 3/5] nvdimm: virtio_pmem: converge broken virtqueue to -EIO Date: Thu, 25 Dec 2025 12:29:11 +0800 Message-ID: <20251225042915.334117-4-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251225042915.334117-1-me@linux.beauty> References: <20251225042915.334117-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" virtio_pmem_flush() waits for either a free virtqueue descriptor (-ENOSPC) or a host completion. If the request virtqueue becomes broken (e.g. virtqueue_kick() notify failure), those waiters may never make progress. Track a device-level broken state and converge all error paths to -EIO. Fail fast for new requests, wake all -ENOSPC waiters, and drain/detach outstanding request tokens to complete them with an error. Signed-off-by: Li Chen --- drivers/nvdimm/nd_virtio.c | 73 +++++++++++++++++++++++++++++++++--- drivers/nvdimm/virtio_pmem.c | 7 ++++ drivers/nvdimm/virtio_pmem.h | 4 ++ 3 files changed, 78 insertions(+), 6 deletions(-) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index d0385d4646f2..de1e3dde85eb 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -17,6 +17,18 @@ static void virtio_pmem_req_release(struct kref *kref) kfree(req); } =20 +static void virtio_pmem_signal_done(struct virtio_pmem_request *req) +{ + WRITE_ONCE(req->done, true); + wake_up(&req->host_acked); +} + +static void virtio_pmem_complete_err(struct virtio_pmem_request *req) +{ + req->resp.ret =3D cpu_to_le32(1); + virtio_pmem_signal_done(req); +} + static void virtio_pmem_wake_one_waiter(struct virtio_pmem *vpmem) { struct virtio_pmem_request *req_buf; @@ -31,6 +43,40 @@ static void virtio_pmem_wake_one_waiter(struct virtio_pm= em *vpmem) wake_up(&req_buf->wq_buf); } =20 +static void virtio_pmem_wake_all_waiters(struct virtio_pmem *vpmem) +{ + struct virtio_pmem_request *req, *tmp; + + list_for_each_entry_safe(req, tmp, &vpmem->req_list, list) { + WRITE_ONCE(req->wq_buf_avail, true); + wake_up(&req->wq_buf); + list_del_init(&req->list); + } +} + +void virtio_pmem_mark_broken_and_drain(struct virtio_pmem *vpmem) +{ + struct virtio_pmem_request *req; + unsigned int len; + + if (READ_ONCE(vpmem->broken)) + return; + + WRITE_ONCE(vpmem->broken, true); + dev_err_once(&vpmem->vdev->dev, "virtqueue is broken\n"); + virtio_pmem_wake_all_waiters(vpmem); + + while ((req =3D virtqueue_get_buf(vpmem->req_vq, &len)) !=3D NULL) { + virtio_pmem_complete_err(req); + kref_put(&req->kref, virtio_pmem_req_release); + } + + while ((req =3D virtqueue_detach_unused_buf(vpmem->req_vq)) !=3D NULL) { + virtio_pmem_complete_err(req); + kref_put(&req->kref, virtio_pmem_req_release); + } +} + /* The interrupt handler */ void virtio_pmem_host_ack(struct virtqueue *vq) { @@ -42,8 +88,7 @@ void virtio_pmem_host_ack(struct virtqueue *vq) spin_lock_irqsave(&vpmem->pmem_lock, flags); while ((req_data =3D virtqueue_get_buf(vq, &len)) !=3D NULL) { virtio_pmem_wake_one_waiter(vpmem); - WRITE_ONCE(req_data->done, true); - wake_up(&req_data->host_acked); + virtio_pmem_signal_done(req_data); kref_put(&req_data->kref, virtio_pmem_req_release); } spin_unlock_irqrestore(&vpmem->pmem_lock, flags); @@ -69,6 +114,9 @@ static int virtio_pmem_flush(struct nd_region *nd_region) return -EIO; } =20 + if (READ_ONCE(vpmem->broken)) + return -EIO; + might_sleep(); req_data =3D kmalloc(sizeof(*req_data), GFP_KERNEL); if (!req_data) @@ -114,22 +162,35 @@ static int virtio_pmem_flush(struct nd_region *nd_reg= ion) spin_unlock_irqrestore(&vpmem->pmem_lock, flags); =20 /* A host response results in "host_ack" getting called */ - wait_event(req_data->wq_buf, READ_ONCE(req_data->wq_buf_avail)); + wait_event(req_data->wq_buf, READ_ONCE(req_data->wq_buf_avail) || + READ_ONCE(vpmem->broken)); spin_lock_irqsave(&vpmem->pmem_lock, flags); + + if (READ_ONCE(vpmem->broken)) + break; } =20 - err1 =3D virtqueue_kick(vpmem->req_vq); + if (err =3D=3D -EIO || virtqueue_is_broken(vpmem->req_vq)) + virtio_pmem_mark_broken_and_drain(vpmem); + + err1 =3D true; + if (!err && !READ_ONCE(vpmem->broken)) { + err1 =3D virtqueue_kick(vpmem->req_vq); + if (!err1) + virtio_pmem_mark_broken_and_drain(vpmem); + } spin_unlock_irqrestore(&vpmem->pmem_lock, flags); /* * virtqueue_add_sgs failed with error different than -ENOSPC, we can't * do anything about that. */ - if (err || !err1) { + if (READ_ONCE(vpmem->broken) || err || !err1) { dev_info(&vdev->dev, "failed to send command to virtio pmem device\n"); err =3D -EIO; } else { /* A host response results in "host_ack" getting called */ - wait_event(req_data->host_acked, READ_ONCE(req_data->done)); + wait_event(req_data->host_acked, READ_ONCE(req_data->done) || + READ_ONCE(vpmem->broken)); err =3D le32_to_cpu(req_data->resp.ret); } =20 diff --git a/drivers/nvdimm/virtio_pmem.c b/drivers/nvdimm/virtio_pmem.c index 2396d19ce549..aa07328e3ff9 100644 --- a/drivers/nvdimm/virtio_pmem.c +++ b/drivers/nvdimm/virtio_pmem.c @@ -25,6 +25,7 @@ static int init_vq(struct virtio_pmem *vpmem) =20 spin_lock_init(&vpmem->pmem_lock); INIT_LIST_HEAD(&vpmem->req_list); + WRITE_ONCE(vpmem->broken, false); =20 return 0; }; @@ -137,6 +138,12 @@ static int virtio_pmem_probe(struct virtio_device *vde= v) static void virtio_pmem_remove(struct virtio_device *vdev) { struct nvdimm_bus *nvdimm_bus =3D dev_get_drvdata(&vdev->dev); + struct virtio_pmem *vpmem =3D vdev->priv; + unsigned long flags; + + spin_lock_irqsave(&vpmem->pmem_lock, flags); + virtio_pmem_mark_broken_and_drain(vpmem); + spin_unlock_irqrestore(&vpmem->pmem_lock, flags); =20 nvdimm_bus_unregister(nvdimm_bus); vdev->config->del_vqs(vdev); diff --git a/drivers/nvdimm/virtio_pmem.h b/drivers/nvdimm/virtio_pmem.h index fc8f613f8f28..49dd2e62d198 100644 --- a/drivers/nvdimm/virtio_pmem.h +++ b/drivers/nvdimm/virtio_pmem.h @@ -44,6 +44,9 @@ struct virtio_pmem { /* List to store deferred work if virtqueue is full */ struct list_head req_list; =20 + /* Fail fast and wake waiters if the request virtqueue is broken. */ + bool broken; + /* Synchronize virtqueue data */ spinlock_t pmem_lock; =20 @@ -53,5 +56,6 @@ struct virtio_pmem { }; =20 void virtio_pmem_host_ack(struct virtqueue *vq); +void virtio_pmem_mark_broken_and_drain(struct virtio_pmem *vpmem); int async_pmem_flush(struct nd_region *nd_region, struct bio *bio); #endif --=20 2.52.0 From nobody Sun Feb 8 03:27:29 2026 Received: from sender4-pp-f112.zoho.com (sender4-pp-f112.zoho.com [136.143.188.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2D7D2D73A1 for ; Thu, 25 Dec 2025 04:30:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.112 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766637019; cv=pass; b=ulxnzYA40trp4WVb+ayCXFV1waepBAgo0jqR17ndnN2PTFBHRyIACeruNoAQuK9PyfL8Cd9iqwBJEP462RsJIHA7NMT55KwrWt4sMaZuXqn1LI6CT3BjjGx83U6MeRiQ61CWo9SoHlog8tA1uqg25BbnF2B0/3nk/uVrR/VoR2U= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766637019; c=relaxed/simple; bh=nSSPLk/HLWPCSAdSLT+cbXEk6rQcq5rhPUFFC3udauk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AvamLKTY4qiuyj4sT+nxIyADXIKDMKkwTKH1gXRcF/0gqSY19HOsN0G3V0gbUXSiwAePqQ/1kRxhAwNe/XzUI/8mwAUYqpXmnjQFeMJe8Fy9LRwIM64Xo1Ukw0pO8n3Ar+lnfdFFqeKSIHWOsyFCNrYF5pqO9whlncMqEsfq3kg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=dv6mI2im; arc=pass smtp.client-ip=136.143.188.112 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="dv6mI2im" ARC-Seal: i=1; a=rsa-sha256; t=1766636982; cv=none; d=zohomail.com; s=zohoarc; b=Zvy/99QaETtzSepEP+M82+j7V7ChGzboKZBSeBcBIH2FSP8cZgZYEb1SS8j+MZ1KgoUnc+I1l8uro1wtKyTzZ1iPG538kEBtfwUQaJtDAl4zIAyLwUqJPwNysUKS1NU8wgnR/R4PRpoHTvjzUF3TZ4yQgVfXsPpihsE2jQFaG7c= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1766636982; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=wLNb/jl0vEDtdEht8xoD9UZAoUmf2MpLAWXKbrRynh4=; b=IhRFqK8tL+aFpohcfgBNkIUtfBlbGIVlNN6o8PS1rpecW80l+6W+r2JRlPeRqfmamCsqp+SJv4dCLw1+e2FmQUNGlaCmYu83fskBWsLq33VFZ7e+34tJHcQuI50AwTfDD+mH+ulhE3z9EY7Uq9MhDpryyb5k91FJWaykbqwshwA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1766636982; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=wLNb/jl0vEDtdEht8xoD9UZAoUmf2MpLAWXKbrRynh4=; b=dv6mI2imyedVSGNeaOrU0uZ+409GjvsVO2wEFKGkyRq1ULltjNuT3hNyi9AaiEJI V2ewKOULH9e3EWYa9o70Im23mZ0W1ui1ptf5yLv0NGjp9fpbusBXpxIAV3Nt95zEn+q gX/c1SKB2/FmOkuULFpORj3RG673aiMyvn+YhXK4= Received: by mx.zohomail.com with SMTPS id 1766636980390385.79513683952234; Wed, 24 Dec 2025 20:29:40 -0800 (PST) From: Li Chen To: Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , Pankaj Gupta , nvdimm@lists.linux.dev, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org Cc: Li Chen Subject: [PATCH V2 4/5] nvdimm: virtio_pmem: drain requests in freeze Date: Thu, 25 Dec 2025 12:29:12 +0800 Message-ID: <20251225042915.334117-5-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251225042915.334117-1-me@linux.beauty> References: <20251225042915.334117-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" virtio_pmem_freeze() deletes virtqueues and resets the device without waking threads waiting for a virtqueue descriptor or a host completion. Mark the request virtqueue broken and drain outstanding requests under pmem_lock before teardown so waiters can make progress and return -EIO. Signed-off-by: Li Chen --- drivers/nvdimm/virtio_pmem.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/nvdimm/virtio_pmem.c b/drivers/nvdimm/virtio_pmem.c index aa07328e3ff9..5c60a7b459d4 100644 --- a/drivers/nvdimm/virtio_pmem.c +++ b/drivers/nvdimm/virtio_pmem.c @@ -152,6 +152,13 @@ static void virtio_pmem_remove(struct virtio_device *v= dev) =20 static int virtio_pmem_freeze(struct virtio_device *vdev) { + struct virtio_pmem *vpmem =3D vdev->priv; + unsigned long flags; + + spin_lock_irqsave(&vpmem->pmem_lock, flags); + virtio_pmem_mark_broken_and_drain(vpmem); + spin_unlock_irqrestore(&vpmem->pmem_lock, flags); + vdev->config->del_vqs(vdev); virtio_reset_device(vdev); =20 --=20 2.52.0 From nobody Sun Feb 8 03:27:29 2026 Received: from sender4-pp-f112.zoho.com (sender4-pp-f112.zoho.com [136.143.188.112]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5DF052D321D for ; Thu, 25 Dec 2025 04:30:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.112 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766637025; cv=pass; b=qzAXR6jNC2ne/iF4LqI6YzIsrljwzoCY/Hrc8abFw43BWfZqpVPoLnH3LDSjpGi/I/xG6wF7j7AKRP9hrAPVH//x3ZhzVu6+Vdq7MEZ0tRyP5/UIbO1ppR33GKHXE1pesbubyMWWwH6OiB0MJxkSW5ILMpbW3WW1h3445FrlsXo= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1766637025; c=relaxed/simple; bh=55SzY24ldDtSnxo2G3CrVEPrzv0tCLXJ3IqzOpti+m4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QMTaPGo0NxC6GhQ0D8h+L/wCVl1Mtx/q+0JH7eQ0SH/Stvll39FsmaT3CI65bJix28+VNiGyFpqtlchGu75z0YQwNj/Qs7XfLbg8ng0NsqRmeILQJhI4JbPnRtVJk+KEd6i6Mzr+AvVctVtxAOJSpJ3iHbfFrW968atmHdc8neI= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=rPCC3Oq4; arc=pass smtp.client-ip=136.143.188.112 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="rPCC3Oq4" ARC-Seal: i=1; a=rsa-sha256; t=1766636986; cv=none; d=zohomail.com; s=zohoarc; b=ZHWDmiZFm0c4mxJ2uFbJEjOeULY8CEOMRfiMOzYe/6iwim0M47iAdxDQeBDv9swr217zYqJbnLMt/MZ86MlF5FI6oQU1PMhVykDtqpWEqXCyOAT9NCOiwq9LTthdlHW4h1g3oKYBwdHZbFuH9yGkRZD8Y4varvVrS+PoKF4LN9o= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1766636986; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=ZaLLvWs/FTLzthUovs5wPF9MHv0tJ1jLPb1vjwsMipQ=; b=egylpVIkOeTX3zBZnTNKW6tXW4xNHmfKBhgypo+tBIyq9g8PzvZ9qcVRbCHMwJmOQFvrqRQ3JeR2IVOy3Pplb64h4YFhpdl6Pxsa64t9RndCJzhAJ/KA6sEKikQiomD6Pnz4aI9OpmsLuum5NRWY+pyqhCae1UyGWxLEjdtmJrE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1766636986; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=ZaLLvWs/FTLzthUovs5wPF9MHv0tJ1jLPb1vjwsMipQ=; b=rPCC3Oq4fdgUO7g2BTGN9Lu+FGpmJ1Hj38/y6pNwufKDf8AbT3mtFFQ74hMa3SAo Qhen/WDfBg3LK2u5E1ZsKWWzGk3X18WKiKjDzLoPmnD4miUtFxa0dur+AJ5lN8F6D+O WI0bBXAe58P0f4ocd/QFWgrZiQ/m5/0Kkpd4FCzU= Received: by mx.zohomail.com with SMTPS id 1766636984247285.5202591420707; Wed, 24 Dec 2025 20:29:44 -0800 (PST) From: Li Chen To: Pankaj Gupta , Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , virtualization@lists.linux.dev, nvdimm@lists.linux.dev, linux-kernel@vger.kernel.org Cc: kernel test robot , Li Chen Subject: [PATCH 5/5] nvdimm: nd_virtio: export virtio_pmem_mark_broken_and_drain Date: Thu, 25 Dec 2025 12:29:13 +0800 Message-ID: <20251225042915.334117-6-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20251225042915.334117-1-me@linux.beauty> References: <20251225042915.334117-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" When CONFIG_VIRTIO_PMEM=3Dm, virtio_pmem.ko calls virtio_pmem_mark_broken_and_drain() from nd_virtio.ko. Export the symbol to fix the modpost undefined error. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202512250116.ewtzlD0g- lkp@intel.com/ Signed-off-by: Li Chen --- drivers/nvdimm/nd_virtio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index de1e3dde85eb..0d13f73ab7f4 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -76,6 +76,7 @@ void virtio_pmem_mark_broken_and_drain(struct virtio_pmem= *vpmem) kref_put(&req->kref, virtio_pmem_req_release); } } +EXPORT_SYMBOL_GPL(virtio_pmem_mark_broken_and_drain); =20 /* The interrupt handler */ void virtio_pmem_host_ack(struct virtqueue *vq) --=20 2.52.0