From nobody Mon Jun 8 07:26:03 2026 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9496038330A for ; Mon, 1 Jun 2026 07:53:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.129.124 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780300426; cv=none; b=TKKNzNWFlaGb3CCoyKwlqxR/DgEjATt7jDCsv5Qw+sznCYX1aPF84U+LFtFVetioygiijob5VaT/eAxPOHfTfQBBevbWq6UPLOs470EVWQVmuY+MVn40qssum7IdEscLuthovkbPD9LCNB4yWlTkhVdltacKRW7U3OtVyhFPrhw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780300426; c=relaxed/simple; bh=CRwG2rJGEDYFeLkd5jVVham1q7EYVpz41iExl2XpiIs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=tvjFZ3El9ap06E5vdWSot5lkcnq4RMJoZbnU9toKtI9GFOU+ZnMOlmj/Ot81YyItImAVgmW/jsKDzjfxm9gtHcfiJ1qmhr/R/DePgzcB4wNsJ2Dk2EWRHpYKArJhao8o/uTJMVO21VpzwtxvDTXU8rhVu6Tu3N17yugdCbQS6e4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=U4/n6ebd; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=hA92zpNx; arc=none smtp.client-ip=170.10.129.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="U4/n6ebd"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="hA92zpNx" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1780300423; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=zIqhrXUwwJrpCl1gMsGp42AZVtWIyb4Pqr0eIXGPoJc=; b=U4/n6ebdYaxZzsw72VnRp1eBYLDP/dLhrr3RLoqLxqSXB3JOTWT5dj6ddBJnlSe3N3oBZC WV28R7VDpPs/q6n0spEepPXizjL1nRwMzXT/TYi6bl2dTGYISYvwySnvR+kaITPf3qOlid TXJ/uO6Zh6B0RW2XN/SGGf7532oqgUc= Received: from mail-pl1-f198.google.com (mail-pl1-f198.google.com [209.85.214.198]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-369-NnYYD_h_Mq6Hn1tj_xSYqA-1; Mon, 01 Jun 2026 03:53:42 -0400 X-MC-Unique: NnYYD_h_Mq6Hn1tj_xSYqA-1 X-Mimecast-MFC-AGG-ID: NnYYD_h_Mq6Hn1tj_xSYqA_1780300421 Received: by mail-pl1-f198.google.com with SMTP id d9443c01a7336-2c0c3315d31so11866725ad.3 for ; Mon, 01 Jun 2026 00:53:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1780300421; x=1780905221; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:from:to:cc:subject:date:message-id:reply-to; bh=zIqhrXUwwJrpCl1gMsGp42AZVtWIyb4Pqr0eIXGPoJc=; b=hA92zpNxPC90BZd6+s7WtHFlhv+P7Q+zHfVfwH3hzJpw3AlIn6yymQYGPcAtV7JOWL zjfEoMsX51eamxrVYez7oC65IEDkZpx/cRHbKTxnG3oxsHOnZzhmsyu/H5L3nbucH0Ly S1bj7bj9AlhXsPwYU4sEe9BrkQsHFPHTwYoeLW5XixLpAOwgZdOonn+qjB1Hcf4r9wdH 9uZvRjRz2tEAsycwQyUHKferS860RsjyMR8M/z+apRQEtuWMmDkBUGJhEbk/g3YSurzo dnXCQtU9UB+lJvYb4f1ocyVYiTwx/vygDeePxY49o5OzfP3EFifFC008twIYufDXgQov 7JZw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780300421; x=1780905221; h=cc:to:message-id:content-transfer-encoding:mime-version:subject :date:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=zIqhrXUwwJrpCl1gMsGp42AZVtWIyb4Pqr0eIXGPoJc=; b=bDi6jhGyqMaTa/FUQ+hRx4zOlB6UQPnsOF+oS3oSUwjgj7ITxscBV2KqVPRvcUctGU cjRodOi0etgumfZaSK/DMg3OkVnFNeofmmk4pAApQqnSoNDFODxQNrD93tVYM/W5YeKp OADolnNvZ0t93i4x3C/Yzi3mPxOVPF1uLpmm6C/FAanwdLPOBeXliVHEFR1Z+mL38axY 0hBqzh9H4V6tDbRDOcW+0A/cw+fZVtRoqN0txXuzwf6FC92Dwy//nwhgTCDDgSU5wzwn 2fFKIBNObT35dESju3W48qYR02Ih6NvKiYyLeBnA2rTQDr25ipznzlz5RPSGfjvnCNtR 52YQ== X-Forwarded-Encrypted: i=1; AFNElJ+JgbGRG2LBn0le/SyDAIEPnLqNBOT6wvrh/thDUc6slozPWmHk3dNPAiWCijel1FowPJuahwveVv16BUo=@vger.kernel.org X-Gm-Message-State: AOJu0YwdcpwHjs+7qTs6Liu2W5mcxqzfrRX+1Bd2s8QOkUw8wJLBf482 Gycuv890q8omBLzG4igQ3dfarcN6NEYfXrRuZ7Njk17ZjAbVGK6ZAkFevAaz/rwWiihegNWVW+m MUkqy5alnqqGS8C0mTS7M5LWxce+C5oMNrHvKzkOLMMnY1aSNqroGOA2zf65Nv9twBA== X-Gm-Gg: Acq92OGjz8bq0qX9eQnXUWxfo7K2OjB9Gsqv6z1AahZfn1N89rUWVGwnkUSDqFy9wVk 1JwXv2MlrmnJWPqK+9s5tKOLw/OMFyFDejv3Er4h12mEe9M3p5rYoRkt9sDcVs9O1aVzZXdRQ/m ytR9B2pc7/ddOUEknRO6HY0qj6ErEcckMzd4H0YdND41AbhXY6dPji7GWRrKPV4iBZ8D9VQFjGH b+TrhNmDJIf3Qpep4G3ZuYOkoY8ysDuOuk9+wBgjQDPy9QjOf2qZLAgKlDXpp+HjKvV8xH+ZXdz g4Me9h8K0MKkeQ7u4X9XBYsPRh0TqBPgAt2pVaE1rQsn98UvNZOtAEiQlx7AJeHm6AWNUDZo3qe 0r4el1NY47B2gGsh2X7L1LyD/B7vQmX1JLEl8fnvu1M6xwhc2XafRghn8ekmrWw+70jumEQ== X-Received: by 2002:a17:902:f78b:b0:2bf:9760:b953 with SMTP id d9443c01a7336-2bf9760bc6bmr96883355ad.14.1780300421010; Mon, 01 Jun 2026 00:53:41 -0700 (PDT) X-Received: by 2002:a17:902:f78b:b0:2bf:9760:b953 with SMTP id d9443c01a7336-2bf9760bc6bmr96883055ad.14.1780300420534; Mon, 01 Jun 2026 00:53:40 -0700 (PDT) Received: from ryasuoka-thinkpadx1carbongen9.tokyo.csb ([126.143.164.49]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2bf239e7483sm93308075ad.14.2026.06.01.00.53.36 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 01 Jun 2026 00:53:40 -0700 (PDT) From: Ryosuke Yasuoka Date: Mon, 01 Jun 2026 16:53:15 +0900 Subject: [PATCH v3] drm/virtio: abort virtqueue wait on device removal to avoid hung task Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260601-virtio-gpu_wait_event-v3-1-89530517a98a@redhat.com> X-B4-Tracking: v=1; b=H4sIAAAAAAAC/3WNyw6CMBBFf4XM2po+LKgr/8MQUukAs5CStlYN6 b9biVuX5yT33BUCesIA52oFj4kCubmA2lXQT2YekZEtDJLLmmtxZIl8JMfG5dE9DcUOE86RaWN 4zRt9GISEsl08DvTaute28EQhOv/ebpL82l9Rij/FJJlgujnVN2UaYbm6eLSTifve3aHNOX8A0 PGvlrsAAAA= X-Change-ID: 20260518-virtio-gpu_wait_event-5aa060754f12 To: David Airlie , Gerd Hoffmann , Dmitry Osipenko , Gurchetan Singh , Chia-I Wu , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , Simona Vetter Cc: dri-devel@lists.freedesktop.org, virtualization@lists.linux.dev, linux-kernel@vger.kernel.org, Ryosuke Yasuoka X-Mailer: b4 0.14.3 virtio_gpu_queue_ctrl_sgs() and virtio_gpu_queue_cursor() use wait_event() without any abort condition when waiting for virtqueue space. If the host device stops processing commands, these waits block indefinitely inside a drm_dev_enter/exit() critical section. Since drm_dev_unplug(), which is called in device removal and system shutdown call path, blocks on synchronize_srcu() until all critical sections complete, device removal and system shutdown also hang. Add a vqs_released flag to virtio_gpu_device and include it in the wait_event() condition. Set the flag and wake up both queues in a new virtio_gpu_release_vqs() helper, called before drm_dev_unplug() in both virtio_gpu_remove() and virtio_gpu_shutdown(). When the flag is set, the wait returns immediately and the command is aborted, following the same cleanup path as drm_dev_enter() failure. Signed-off-by: Ryosuke Yasuoka --- Changes in v3: - Remove Reported-by and Closes tag from commit msg because they are not related to this fix. - Link to v2: https://lore.kernel.org/r/20260521-virtio-gpu_wait_event-v2-1= -5796b3a71d03@redhat.com Changes in v2: - Update the commit message. - Replace wait_event_timeout() with wait_event() using a compound condition that includes a new vqs_released flag. - Add virtio_gpu_release_vqs() helper to set the flag and wake up both queues, called before drm_dev_unplug() in remove and shutdown paths. - Remove the hardcoded 5-second timeout. Recovery is now driven by the driver flag instead of an arbitrary timeout value. --- drivers/gpu/drm/virtio/virtgpu_drv.c | 15 +++++++++++++++ drivers/gpu/drm/virtio/virtgpu_drv.h | 1 + drivers/gpu/drm/virtio/virtgpu_vq.c | 23 +++++++++++++++++++++-- 3 files changed, 37 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.c b/drivers/gpu/drm/virtio/= virtgpu_drv.c index a5ce96fb8a1d..e4fe5e0780f9 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.c +++ b/drivers/gpu/drm/virtio/virtgpu_drv.c @@ -119,10 +119,24 @@ static int virtio_gpu_probe(struct virtio_device *vde= v) return ret; } =20 +/* + * Release pending virtqueue waits so the drm_dev_enter/exit() critical + * sections complete before drm_dev_unplug() blocks on synchronize_srcu(). + */ +static void virtio_gpu_release_vqs(struct drm_device *dev) +{ + struct virtio_gpu_device *vgdev =3D dev->dev_private; + + vgdev->vqs_released =3D true; + wake_up_all(&vgdev->ctrlq.ack_queue); + wake_up_all(&vgdev->cursorq.ack_queue); +} + static void virtio_gpu_remove(struct virtio_device *vdev) { struct drm_device *dev =3D vdev->priv; =20 + virtio_gpu_release_vqs(dev); drm_dev_unplug(dev); drm_atomic_helper_shutdown(dev); virtio_gpu_deinit(dev); @@ -133,6 +147,7 @@ static void virtio_gpu_shutdown(struct virtio_device *v= dev) { struct drm_device *dev =3D vdev->priv; =20 + virtio_gpu_release_vqs(dev); /* stop talking to the device */ drm_dev_unplug(dev); } diff --git a/drivers/gpu/drm/virtio/virtgpu_drv.h b/drivers/gpu/drm/virtio/= virtgpu_drv.h index 2f3531950aa4..5f7bb6cc6ba7 100644 --- a/drivers/gpu/drm/virtio/virtgpu_drv.h +++ b/drivers/gpu/drm/virtio/virtgpu_drv.h @@ -235,6 +235,7 @@ struct virtio_gpu_device { =20 struct virtio_gpu_queue ctrlq; struct virtio_gpu_queue cursorq; + bool vqs_released; struct kmem_cache *vbufs; =20 atomic_t pending_commands; diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/v= irtgpu_vq.c index 67865810a2e7..8057a9b7356d 100644 --- a/drivers/gpu/drm/virtio/virtgpu_vq.c +++ b/drivers/gpu/drm/virtio/virtgpu_vq.c @@ -396,7 +396,19 @@ static int virtio_gpu_queue_ctrl_sgs(struct virtio_gpu= _device *vgdev, if (vq->num_free < elemcnt) { spin_unlock(&vgdev->ctrlq.qlock); virtio_gpu_notify(vgdev); - wait_event(vgdev->ctrlq.ack_queue, vq->num_free >=3D elemcnt); + wait_event(vgdev->ctrlq.ack_queue, + vq->num_free >=3D elemcnt || vgdev->vqs_released); + /* + * Set by virtio_gpu_release_vqs() to unblock + * synchronize_srcu() wait in drm_dev_unplug(). + */ + if (vgdev->vqs_released) { + if (fence && vbuf->objs) + virtio_gpu_array_unlock_resv(vbuf->objs); + free_vbuf(vgdev, vbuf); + drm_dev_exit(idx); + return -ENODEV; + } goto again; } =20 @@ -566,7 +578,14 @@ static void virtio_gpu_queue_cursor(struct virtio_gpu_= device *vgdev, ret =3D virtqueue_add_sgs(vq, sgs, outcnt, 0, vbuf, GFP_ATOMIC); if (ret =3D=3D -ENOSPC) { spin_unlock(&vgdev->cursorq.qlock); - wait_event(vgdev->cursorq.ack_queue, vq->num_free >=3D outcnt); + wait_event(vgdev->cursorq.ack_queue, + vq->num_free >=3D outcnt || vgdev->vqs_released); + /* See comment in virtio_gpu_queue_ctrl_sgs(). */ + if (vgdev->vqs_released) { + free_vbuf(vgdev, vbuf); + drm_dev_exit(idx); + return; + } spin_lock(&vgdev->cursorq.qlock); goto retry; } else { --- base-commit: e43ffb69e0438cddd72aaa30898b4dc446f664f8 change-id: 20260518-virtio-gpu_wait_event-5aa060754f12 Best regards, --=20 Ryosuke Yasuoka