From nobody Sun May 24 22:42:29 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC1C33655C4 for ; Thu, 21 May 2026 02:19:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779330003; cv=none; b=CHs822B2gocji7oSUJrBlYnCBDMRk7OQ+VIu+4CKtV6Ox5PCWN4ZbQCcFnwsEqssic/Rzpn4/GtIs64cIHr9TtJXyz53pJlDMupXjn/hNffZ+MspJ8ROEoCMS3MzsEf/GqWTRMBB6Qph1tqRdOye9uP3pAHUv0k8ePrJh8nZvRQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779330003; c=relaxed/simple; bh=ni6G5U+k1G9Sw9K9BmbNeEkePNB5kcEvXutkwaGb5sA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=E7RvPzpl+FDQjY+FENwCl30Qp+Jbhcmoa+enYcQuWJk1Qw/tAtjUjQ0fqeQ8l6Alr1QIolyRh0AxaUTZ9+x3WhKhhfrnObSsU9hRtnWnh3+/8Mn3HWsR9qNFcMs7z8gSM5DgjGdu8BvOoLeaMB6/j7SePKYS7dhlDPQ/ew+k6jE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=FHpU51gQ; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=grRSoiFB; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="FHpU51gQ"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="grRSoiFB" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1779329986; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ViVUeVTHXm/181QtK6ZWvQ/pgMe3DIC+vbJkDxzogvM=; b=FHpU51gQw5S7gGnixPJg9aSEznm1qqtzP9RIefNEKVUFgRLxk8IEy7GdG7nK8rMQnMTjHs DbLSmwUQlCczNdt/FaTPva/aEDCTYl2GosgPTMuULCxO78TTRVQzfdangrTmIw/kky+52H VvqfEz6tEqPIklMpH22z2JLDy39Rsdg= Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-310-F-v0iLXEMIunblgXRfFh5g-1; Wed, 20 May 2026 22:19:45 -0400 X-MC-Unique: F-v0iLXEMIunblgXRfFh5g-1 X-Mimecast-MFC-AGG-ID: F-v0iLXEMIunblgXRfFh5g_1779329984 Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-c828f0f5c23so2633968a12.1 for ; Wed, 20 May 2026 19:19:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1779329984; x=1779934784; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=ViVUeVTHXm/181QtK6ZWvQ/pgMe3DIC+vbJkDxzogvM=; b=grRSoiFBQgcWUDQvhDUWQ2gS6fu2eXjumYiGThs2QNUAmTL7IfqaQ1ygaBzIrZ2cOB V1DkEYKzrI8wG8cFqrnR5IDPRm7HpUmtMnVhmeDFxdYAUQ54czyAggs2OyD2iFpOxJdH y7bcvdLXq3TRFeCFysOM/fJdVjsOx9TrsB5U9oSy1/LEiHU9BwmmHMW4BEdmy7f6N7ft VkpnEz8XQj94M2elRt1zuhqrSHUnr7eTd0SW/oVDENkJhzwCVipAhWXrv9ldeYSDCGYC spCGN/8OPh0+vrmBADoo1etEwudOMjFyFTYJ7LGdd8eAt+3mgRfL+8ag+TwS7codxpvm 66Mw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779329984; x=1779934784; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=ViVUeVTHXm/181QtK6ZWvQ/pgMe3DIC+vbJkDxzogvM=; b=avnY/IMm3wubhLvT2OO86PVrZ1+PjbRl8Wvm+X0YgvX7Gr3zuqUokcNkfOOvmLY1yS umXRLNxqbInFFWWm1EVmZA7S5HukG40MguKguX891yBkHHas8ATvDZKrtBTA5Mve5/pV 7Uo+w9pyfmBITWQPe+f4ew1OTImfbQJ0wK8gOXpd7OddWCU6HGsTM9PwtvjgWrNDPFj0 cv0g7bdhBvObbQu3z/HKP6iAYxM/a8jzFI4wDC+ylTwAQxeu4tw8H5huNHERQBRxhyqX Os5sSMb2P2uRR/JnE9n3ebBC3dTuMSO1htgtW8Qxn5vkPxvJpfdBIcoAONZ3eZeXaubL hcdw== X-Forwarded-Encrypted: i=1; AFNElJ+slV/3ft5lBCC+2RPqTKzMtRD6PKvdna5w3Mn1/BZteAxOlJCI4CiRyKUDXqp4nr6nuBcH1ak/LtaWciE=@vger.kernel.org X-Gm-Message-State: AOJu0Yxo0ir+H4jcuXYHJck+7aEcqWFzmfqdI+EnEk8A0Y7c3YXrfbmY 2u4OjEZLk9OAcJTq9fBmMyDapBaxBqzvAH463IsqGuF3wGEJ6Rty7Hq9UofVlDaBafAUVTEfZ1C trjZH9rJUUE5uEk71yw3/f0HPBNxXyDOumFJspgkY7ISHIiDwuzTCfGVDNdu8nUmY+u1/R6sa6u KH X-Gm-Gg: Acq92OExPALzREOnrtrPp7dibDudCro+ZS5Cab8QhC512hxgq19ORf4vdHkrKrCkv5W OopEiW4xqpg8R9MKTsTTd/0/gpLEbZ8Ezox74S+kR2BcQX9H7cw3Wa2SYFgimU8rf8F8fD8GtsD no1HVolP0veTpuGrcy42Bl8Rdb+q4yIOHQ3a9RF9JFM6NeKSA10YhXDYJnXoRmth0MD2A9/aXty yFoKWcxg7k5Wj7+81FHMLZ/utnVSFDHhUhP8AZFfXs7HrTdpQXN5cdCjaX3n/WSdLpRq8gGvp/i VD8EBfZZBtRIs7J/H+oTRKamRkxMdOoQ7xPAYqM8BUyBJDoDnC2N0Kp2CW5S+PwkALN7shlhA5d 6kcjpCQvwJ//FA6UvVacQkT1bwBilXXKPIUTZ9yfBWN6k0S9rgyC43UynYMw= X-Received: by 2002:a05:6a00:aa06:b0:82c:d6d3:3190 with SMTP id d2e1a72fcca58-8414ae0ed26mr938748b3a.38.1779329983824; Wed, 20 May 2026 19:19:43 -0700 (PDT) X-Received: by 2002:a05:6a00:aa06:b0:82c:d6d3:3190 with SMTP id d2e1a72fcca58-8414ae0ed26mr938716b3a.38.1779329983304; Wed, 20 May 2026 19:19:43 -0700 (PDT) Received: from ryasuoka-thinkpadx1carbongen9.tokyo.csb ([126.143.164.49]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-83f19f7cc9asm28041546b3a.53.2026.05.20.19.19.38 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 20 May 2026 19:19:42 -0700 (PDT) From: Ryosuke Yasuoka Date: Thu, 21 May 2026 11:19:35 +0900 Subject: [PATCH v2] drm/virtio: abort virtqueue wait on device removal to avoid hung task Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260521-virtio-gpu_wait_event-v2-1-5796b3a71d03@redhat.com> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/x3MQQqAIBBA0avErBNUsqKrRIjUWLMxUbNAunvS8 i3+LxAxEEaYmgIBM0U6XYVsG1gP43ZktFWD5LLnSowsU0h0st1f+jaUNGZ0iSljeM8H1VkhobY +oKXn/87L+37DcNH7ZwAAAA== X-Change-ID: 20260518-virtio-gpu_wait_event-5aa060754f12 To: David Airlie , Gerd Hoffmann , Dmitry Osipenko , Gurchetan Singh , Chia-I Wu , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Simona Vetter Cc: dri-devel@lists.freedesktop.org, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, syzbot+d6dd6f86d3aaf7eebe7406e45c1c6e549453f224@syzkaller.appspotmail.com, syzbot+908bd910da5dd79b88de4cf7baf376cc873a922e@syzkaller.appspotmail.com, Ryosuke Yasuoka X-Mailer: b4 0.14.3 virtio_gpu_queue_ctrl_sgs() and virtio_gpu_queue_cursor() use wait_event() without any abort condition when waiting for virtqueue space. If the host device stops processing commands, these waits block indefinitely inside a drm_dev_enter/exit() critical section. Since drm_dev_unplug(), which is called in device removal and system shutdown call path, blocks on synchronize_srcu() until all critical sections complete, device removal and system shutdown also hang. Add a vqs_released flag to virtio_gpu_device and include it in the wait_event() condition. Set the flag and wake up both queues in a new virtio_gpu_release_vqs() helper, called before drm_dev_unplug() in both virtio_gpu_remove() and virtio_gpu_shutdown(). When the flag is set, the wait returns immediately and the command is aborted, following the same cleanup path as drm_dev_enter() failure. Reported-by: syzbot+d6dd6f86d3aaf7eebe7406e45c1c6e549453f224@syzkaller.apps= potmail.com Closes: https://syzkaller.appspot.com/bug?id=3Dd6dd6f86d3aaf7eebe7406e45c1c= 6e549453f224 Reported-by: syzbot+908bd910da5dd79b88de4cf7baf376cc873a922e@syzkaller.apps= potmail.com Closes: https://syzkaller.appspot.com/bug?id=3D908bd910da5dd79b88de4cf7baf3= 76cc873a922e Signed-off-by: Ryosuke Yasuoka --- Changes in v2: - Update the commit message. - Replace wait_event_timeout() with wait_event() using a compound condition that includes a new vqs_released flag. - Add virtio_gpu_release_vqs() helper to set the flag and wake up both queues, called before drm_dev_unplug() in remove and shutdown paths. - Remove the hardcoded 5-second timeout. Recovery is now driven by the driver flag instead of an arbitrary timeout value. --- drivers/gpu/drm/virtio/virtgpu_drv.c | 15 +++++++++++++++ drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_vq.c | 23 +++++++++++++++++++++-- 3 files changed, 37 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/= virtgpu_drv.c index a5ce96fb8a1d..e4fe5e0780f9 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.c +++ b/drivers/gpu/drm/virtio/virtgpu_drv.c @@ -119,10 +119,24 @@ static int virtio_gpu_probe(struct virtio_device *vde= v) return ret; } =20 +/* + * Release pending virtqueue waits so the drm_dev_enter/exit() critical + * sections complete before drm_dev_unplug() blocks on synchronize_srcu(). + */ +static void virtio_gpu_release_vqs(struct drm_device *dev) +{ + struct virtio_gpu_device *vgdev =3D dev->dev_private; + + vgdev->vqs_released =3D true; + wake_up_all(&vgdev->ctrlq.ack_queue); + wake_up_all(&vgdev->cursorq.ack_queue); +} + static void virtio_gpu_remove(struct virtio_device *vdev) { struct drm_device *dev =3D vdev->priv; =20 + virtio_gpu_release_vqs(dev); drm_dev_unplug(dev); drm_atomic_helper_shutdown(dev); virtio_gpu_deinit(dev); @@ -133,6 +147,7 @@ static void virtio_gpu_shutdown(struct virtio_device *v= dev) { struct drm_device *dev =3D vdev->priv; =20 + virtio_gpu_release_vqs(dev); /* stop talking to the device */ drm_dev_unplug(dev); } diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/= virtgpu_drv.h index f17660a71a3e..0bd69a40857e 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.h +++ b/drivers/gpu/drm/virtio/virtgpu_drv.h @@ -235,6 +235,7 @@ struct virtio_gpu_device { =20 struct virtio_gpu_queue ctrlq; struct virtio_gpu_queue cursorq; + bool vqs_released; struct kmem_cache *vbufs; =20 atomic_t pending_commands; diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/v= irtgpu_vq.c index 67865810a2e7..8057a9b7356d 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -396,7 +396,19 @@ static int virtio_gpu_queue_ctrl_sgs(struct virtio_gpu= _device *vgdev, if (vq->num_free < elemcnt) { spin_unlock(&vgdev->ctrlq.qlock); virtio_gpu_notify(vgdev); - wait_event(vgdev->ctrlq.ack_queue, vq->num_free >=3D elemcnt); + wait_event(vgdev->ctrlq.ack_queue, + vq->num_free >=3D elemcnt || vgdev->vqs_released); + /* + * Set by virtio_gpu_release_vqs() to unblock + * synchronize_srcu() wait in drm_dev_unplug(). + */ + if (vgdev->vqs_released) { + if (fence && vbuf->objs) + virtio_gpu_array_unlock_resv(vbuf->objs); + free_vbuf(vgdev, vbuf); + drm_dev_exit(idx); + return -ENODEV; + } goto again; } =20 @@ -566,7 +578,14 @@ static void virtio_gpu_queue_cursor(struct virtio_gpu_= device *vgdev, ret =3D virtqueue_add_sgs(vq, sgs, outcnt, 0, vbuf, GFP_ATOMIC); if (ret =3D=3D -ENOSPC) { spin_unlock(&vgdev->cursorq.qlock); - wait_event(vgdev->cursorq.ack_queue, vq->num_free >=3D outcnt); + wait_event(vgdev->cursorq.ack_queue, + vq->num_free >=3D outcnt || vgdev->vqs_released); + /* See comment in virtio_gpu_queue_ctrl_sgs(). */ + if (vgdev->vqs_released) { + free_vbuf(vgdev, vbuf); + drm_dev_exit(idx); + return; + } spin_lock(&vgdev->cursorq.qlock); goto retry; } else { --- base-commit: 5200f5f493f79f14bbdc349e402a40dfb32f23c8 change-id: 20260518-virtio-gpu_wait_event-5aa060754f12 Best regards, --=20 Ryosuke Yasuoka