From nobody Thu Jun 11 05:50:53 2026 Received: from sender4-op-o15.zoho.com (sender4-op-o15.zoho.com [136.143.188.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D85203E3C69 for ; Tue, 9 Jun 2026 12:08:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.15 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006889; cv=pass; b=UUieAfCHyNZsSXlYTfa6DwwhX1OG6WeGFMiOu9KCHIk5lWC7zTtrPHTzzt4s+uGV0tEjMHp2/d77G7ISwyPkGeW9ayzUhTxGwloMS6Mr+fI6mspwF75fCyXPnnvm4seUXB6bcXf6OgY3lNpmCq/NNAGO3VkDHKaeBRhLuxYJ3s0= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006889; c=relaxed/simple; bh=BObJGRZzmtRxVfVzdFlLpRgDXZJViibwtMW5khQwtNY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=N3l1MUiILxePmoKQThFo47/+1WK60mQhM5DT2dwT2RP8l0gy77LKHXjMeEVRUHiiO+Cq2amD1Nz57+Y+54u0yDROBsJXnnZGNuA7AQHMYL0RaDwkCt9fAdSBvUj5eyDivm+dbl0sOfTNtIiLvIfixU93KgTzGGEXcJU3IP3XaeM= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=FYCh9wV+; arc=pass smtp.client-ip=136.143.188.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="FYCh9wV+" ARC-Seal: i=1; a=rsa-sha256; t=1781006873; cv=none; d=zohomail.com; s=zohoarc; b=Z7f4D1DCsyyH7K2l1pkEwzPZIeqLYBgbssLY/1dI4Z2BGfucdNeW/G7iEe76tQXQLkUPK8xEXnVSNtFE7/UPg7JdrAu/CXh5xhffBQNJJwv2h5AojUVxVgqbrnpantGToJFu0TyBzHuONAtNMa7mxsSNI3nWrL3etZfZD3tXK2Q= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781006873; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=Kkm6b8v9HrmRxgveYsXGJWG4c5oEBQ3malO2AScRBME=; b=d4aRUbnXSEtAVyWFooyhcRTOr5POKr4xrWhdXZTk65+nrsR/kc2K0Q6Fn11PlO0UiUqNyDESN8DT3zUxwL8pk5oF6Fsys7DwOH6B84EGg/3DjgtJK4zmcVUXHYfn+K15S/pAQPFNMp2nL05zLwr9/zSnSdsu7IptHd+QmJbNZNk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1781006873; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=Kkm6b8v9HrmRxgveYsXGJWG4c5oEBQ3malO2AScRBME=; b=FYCh9wV+yIf7hSrcaOeZJqCInwUkbN3Cg3WkA87V23chxsMSertwLV/s/BgKC1ID xoGmVYs62pIoLP05wos36falIETFHB4pj2AcIBwPlNxIl0aOLefU6OCVfxrBaPBfycp mWH9eaW9II4rMcvoHBK8sxWPNxbhZDo+UoKhBzi8= Received: by mx.zohomail.com with SMTPS id 1781006870001907.9313856047778; Tue, 9 Jun 2026 05:07:50 -0700 (PDT) From: Li Chen To: Pankaj Gupta , Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , Alison Schofield , virtualization@lists.linux.dev, nvdimm@lists.linux.dev Cc: linux-kernel@vger.kernel.org, Li Chen Subject: [PATCH v4 1/7] nvdimm: preserve flush callback errors Date: Tue, 9 Jun 2026 20:07:15 +0800 Message-ID: <20260609120726.1714780-2-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260609120726.1714780-1-me@linux.beauty> References: <20260609120726.1714780-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" nvdimm_flush() currently converts any non-zero provider flush error to -EIO. That loses useful errno values from provider callbacks. A local virtio-pmem mkfs sanity test showed the masking clearly: wipefs: /dev/pmem0: cannot flush modified buffers: Input/output error mkfs.ext4: Input/output error while writing out and closing file system nd_region region0: dbg: nvdimm_flush rc=3D-5 The virtio-pmem callback can return -ENOMEM when async_pmem_flush() fails to allocate a child flush bio, but nvdimm_flush() hides that as -EIO before pmem_submit_bio() converts it to a block status. Return the provider callback error directly. The generic flush path still returns 0, and pmem_submit_bio() already handles errno-to-blk_status conversion for bio completion. Signed-off-by: Li Chen --- v3->v4: - New patch. drivers/nvdimm/region_devs.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c index e35c2e18518f0..0cd96503c0596 100644 --- a/drivers/nvdimm/region_devs.c +++ b/drivers/nvdimm/region_devs.c @@ -1114,10 +1114,8 @@ int nvdimm_flush(struct nd_region *nd_region, struct= bio *bio) =20 if (!nd_region->flush) rc =3D generic_nvdimm_flush(nd_region); - else { - if (nd_region->flush(nd_region, bio)) - rc =3D -EIO; - } + else + rc =3D nd_region->flush(nd_region, bio); =20 return rc; } --=20 2.52.0 From nobody Thu Jun 11 05:50:53 2026 Received: from sender4-op-o15.zoho.com (sender4-op-o15.zoho.com [136.143.188.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0AB4A40BCD0 for ; Tue, 9 Jun 2026 12:08:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.15 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006895; cv=pass; b=IOvWKKGBn1tuxzkCzlvXqJvtcF/ZP4b4/po5Y8XjsQ/I2md/oychqvKZgTpA6EsHqU/p9XvQCpKZpc+PCJ9r/r7S6dlD6ixoUo/7rQ8O6bl22uHytoPpFAeV78tTKotORuagtIOC/qkMHn0biVnaFQ7eBFqL/0GWZJ/0vSd23TA= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006895; c=relaxed/simple; bh=0IknSZs+CZ2aWmgORtDW0RLrqT1UT710/Y0X+nmzfrs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XTAzE3q1aMJmeTMP6zZjQ9OTuKn5if5fJqnf5BRb0DXhGJfUyUYhLmUvCnLEdXGeJ5DHmsi8Xl/j0zS64oxmxPN80u/41lz1FabiWi8KvTG2J+FflfaTNNwR7YnBGIyHlWm9PS31oMWSgxgVnkNvwrtF//4yZildPaZBZa4YIHU= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=X4nSMQKL; arc=pass smtp.client-ip=136.143.188.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="X4nSMQKL" ARC-Seal: i=1; a=rsa-sha256; t=1781006877; cv=none; d=zohomail.com; s=zohoarc; b=SdBUhFRRiHwe0Z/MI26OU/qxJr/5zJB0rBn8v+63+MSfwHkzmhdyuZmygkf1tLL0YaQpmK0yIaSIfb7K0siCbO9AUmvynHDya6sP7CMpBb3kaouefsD3FM/SNxaGqCr3IBcJ5fBO1wUHnHoi8xn0Amvm3brhbZV/s7Aqi2vJ47c= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781006877; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=gPpF3KoeRkWvCn/WAd7dxNBXjTnxN4iFAXPZPuhQ5Bc=; b=jgPKqa5Y3WCuenyYcgsBTln9fIO2kVuxuEm6dTdxpgoRK1D75gqdZnipNCSgyUfb8/OxYoB54pT3Hn78U2u/OEy9MrsgxyMIDktH7Bmt3DhHuXEAU8L9lLwDiy0nwy6yX4+L6Rq43knQY8RFG7eHBz+vOdd6zx5HSQkZpeX2GaY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1781006876; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=gPpF3KoeRkWvCn/WAd7dxNBXjTnxN4iFAXPZPuhQ5Bc=; b=X4nSMQKLEZfo/+ij+4QVzjhlZ6uloJowd/b/Fu/RscALXNsbsO5aWbwx2LLmmD2u U7EegZwOJjpn0bWbVG/HhoFkiADezJArulTH881cnQf5mKutG6i9GTzkqjHxj8qrmKJ 6cf6Vylk4Bw90AKHMB28JxNxDTh65ZypEJ8e1B2E= Received: by mx.zohomail.com with SMTPS id 1781006874820153.56041895581916; Tue, 9 Jun 2026 05:07:54 -0700 (PDT) From: Li Chen To: Pankaj Gupta , Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , Alison Schofield , virtualization@lists.linux.dev, nvdimm@lists.linux.dev Cc: linux-kernel@vger.kernel.org, Li Chen Subject: [PATCH v4 2/7] nvdimm: virtio_pmem: use GFP_NOIO for child flush bio Date: Tue, 9 Jun 2026 20:07:16 +0800 Message-ID: <20260609120726.1714780-3-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260609120726.1714780-1-me@linux.beauty> References: <20260609120726.1714780-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" async_pmem_flush() can allocate a child flush bio from filesystem flush and writeback paths. GFP_ATOMIC is unnecessarily restrictive there and can make the allocation fail under pressure, which then propagates -ENOMEM to the flush caller. A local virtio-pmem mkfs sanity test hit a flush failure before this change: wipefs: /dev/pmem0: cannot flush modified buffers: Input/output error mkfs.ext4: Input/output error while writing out and closing file system nd_region region0: dbg: nvdimm_flush rc=3D-5 The debug log showed async_pmem_flush() was entered and nvdimm_flush() returned -EIO. With GFP_NOIO, the same test reached mkfs_rc=3D0, mount_rc= =3D0, and umount_rc=3D0. Use GFP_NOIO instead. The path may sleep, but it must not recurse into filesystem I/O reclaim while it is already servicing a flush request. Signed-off-by: Li Chen --- v3->v4: - New patch. drivers/nvdimm/nd_virtio.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index 4176046627beb..081370aac6317 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -117,7 +117,7 @@ int async_pmem_flush(struct nd_region *nd_region, struc= t bio *bio) if (bio && bio->bi_iter.bi_sector !=3D -1) { struct bio *child =3D bio_alloc(bio->bi_bdev, 0, REQ_OP_WRITE | REQ_PREFLUSH, - GFP_ATOMIC); + GFP_NOIO); =20 if (!child) return -ENOMEM; --=20 2.52.0 From nobody Thu Jun 11 05:50:53 2026 Received: from sender4-op-o15.zoho.com (sender4-op-o15.zoho.com [136.143.188.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9A03431197C for ; Tue, 9 Jun 2026 12:08:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.15 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006901; cv=pass; b=dYjwH4vDcFhGeqPSniinhTKwppiAm3/6fYWjS6eKym+SWVjMrMDz8WpHXcWyE571py5xrLquLNSj/n+bobkoiuCf/hE6MslaVFE0JvN2meXOTGp4zwbocLF/D3osI9GGs9o2jC9t6aCLBNkMkSZAbtVGUU1GToKkLLEP4ahHNcM= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006901; c=relaxed/simple; bh=GnBkHB2tsKfOTSBG+XpIVJrTWoi3EyC6RCw9K5pXf/Y=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Hzg498KSFFnz+ezHTNOMZbdvbzr+OiG2ml8Gf/2AayO2/UlwaMMMt0phtFBcTfSq1bdMuGU6MTTO/BMOO6r6zkl1+By1ypzpsE68DjqVzmdUjCCmhPn3hUUhvhnom5Ytwcd4H4lNxuVUIch1SZ72Zda+VOGzdAzKuZMFJvXyMfg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=gYEx9tWk; arc=pass smtp.client-ip=136.143.188.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="gYEx9tWk" ARC-Seal: i=1; a=rsa-sha256; t=1781006880; cv=none; d=zohomail.com; s=zohoarc; b=O/qvyAqrW+dQ1Kop74v0Xm88JRX0qF/AuBdG+EHe55MhDKSTI3TgMZ8KTtLGojmZh6MxnS+OXV51W1z17XL6bBtObgPkPutkfBF7CHDuQziq9LZesXqH1ZrjfWGXg803ZFhx2rDx7ec6vUAsrdgH+BlOsXmMOGefEMLgTvPauts= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781006880; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=79C1DXTtv5mIJ7drNEJRTgyEFf08rMj3no/LbB3sb3I=; b=hSZQ+mbDJ81XTY5ZQah9jOhHD3M9evvngtn+KZPw9e9xZAoGVVswX3N5s2yEziTKzBIVAfC9GwEaO+vRjlKKPInJvbF8wQnHGgtVOMyR1DRRvjWEiYsf2rnBxPAitm2jAYO6PTOs2XobE3OD/tWv89q7zjDgWy7wZYhJ+ABsHZc= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1781006880; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=79C1DXTtv5mIJ7drNEJRTgyEFf08rMj3no/LbB3sb3I=; b=gYEx9tWk1NNnsoZ0klsu87jLlfYkMPSB74Iacv+RS2zokoQQrcoge6GmDgWe7X+D EMIsEieR7GubYhEK+e//Ocn8glbZgZvyxhuyrTpNNdHlWE+RO9pwiObQA1LTLgRr+eH SApfma+ac/smT2JksRHOEPjr3Y4x9894WM3AQT8Y= Received: by mx.zohomail.com with SMTPS id 1781006878827833.794050155962; Tue, 9 Jun 2026 05:07:58 -0700 (PDT) From: Li Chen To: Pankaj Gupta , Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , Alison Schofield , virtualization@lists.linux.dev, nvdimm@lists.linux.dev Cc: linux-kernel@vger.kernel.org, Li Chen Subject: [PATCH v4 3/7] nvdimm: virtio_pmem: always wake -ENOSPC waiters Date: Tue, 9 Jun 2026 20:07:17 +0800 Message-ID: <20260609120726.1714780-4-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260609120726.1714780-1-me@linux.beauty> References: <20260609120726.1714780-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" virtio_pmem_host_ack() reclaims virtqueue descriptors with virtqueue_get_buf(). The -ENOSPC waiter wakeup is tied to completing the returned token. If token completion is skipped for any reason, reclaimed descriptors may not wake a waiter and the submitter may sleep forever waiting for a free slot. Always wake one -ENOSPC waiter for each virtqueue completion before touching the returned token. Signed-off-by: Li Chen --- v2->v3: - Split out the waiter wakeup ordering change from READ_ONCE()/WRITE_ONCE() updates (now patch 4/7), per Pankaj's suggestion. v3->v4: - Rebased onto v7.1-rc7 and renumbered after the flush error patches. drivers/nvdimm/nd_virtio.c | 25 ++++++++++++++++--------- 1 file changed, 16 insertions(+), 9 deletions(-) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index 081370aac6317..16ee5a47b9938 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -9,26 +9,33 @@ #include "virtio_pmem.h" #include "nd.h" =20 +static void virtio_pmem_wake_one_waiter(struct virtio_pmem *vpmem) +{ + struct virtio_pmem_request *req_buf; + + if (list_empty(&vpmem->req_list)) + return; + + req_buf =3D list_first_entry(&vpmem->req_list, + struct virtio_pmem_request, list); + req_buf->wq_buf_avail =3D true; + wake_up(&req_buf->wq_buf); + list_del(&req_buf->list); +} + /* The interrupt handler */ void virtio_pmem_host_ack(struct virtqueue *vq) { struct virtio_pmem *vpmem =3D vq->vdev->priv; - struct virtio_pmem_request *req_data, *req_buf; + struct virtio_pmem_request *req_data; unsigned long flags; unsigned int len; =20 spin_lock_irqsave(&vpmem->pmem_lock, flags); while ((req_data =3D virtqueue_get_buf(vq, &len)) !=3D NULL) { + virtio_pmem_wake_one_waiter(vpmem); req_data->done =3D true; wake_up(&req_data->host_acked); - - if (!list_empty(&vpmem->req_list)) { - req_buf =3D list_first_entry(&vpmem->req_list, - struct virtio_pmem_request, list); - req_buf->wq_buf_avail =3D true; - wake_up(&req_buf->wq_buf); - list_del(&req_buf->list); - } } spin_unlock_irqrestore(&vpmem->pmem_lock, flags); } --=20 2.52.0 From nobody Thu Jun 11 05:50:53 2026 Received: from sender4-op-o15.zoho.com (sender4-op-o15.zoho.com [136.143.188.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1119D31197C for ; Tue, 9 Jun 2026 12:08:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.15 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006907; cv=pass; b=pojXpfclW66V+Btoanu3WqeRI3z6Sl9cTwlkx2LWRExKMZ7IwgJ1pua0FRTzAUjK5hAthrAXAY+WHb9XeZLgXL5C/l1uDmzWqsow/iX8Df8E5Tek9awG0mK6plgi/aYoq9SYAfBtW2bR9aXHq6lCRMn4tWtUwAyxkSYAvsTMDmc= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006907; c=relaxed/simple; bh=G0IOvAY7QjaiQjumjwhpfVDBmEKpe3sSiqm2aC2Qdcg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=pYZc8J6W8ZPK/xQMDe1979Bv0IF6ip5B3NTWV0SWIybqti/v8wHVM2UWJr4PuuCiua5FHt3phBsUTBGtAgHBimEnc09hu85NQQ8P2GRmwaj1ic4HQ1DLuqxA0uqY+rOvIScWOTt03Ls1O5laxswfj6UJtae4kgWJtdTdaQ0cpq8= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=s2KyggbR; arc=pass smtp.client-ip=136.143.188.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="s2KyggbR" ARC-Seal: i=1; a=rsa-sha256; t=1781006885; cv=none; d=zohomail.com; s=zohoarc; b=AORPKi3L4bUcSUKx7oZysQc4fS5pvTLoA6uUg0kYaCR48NwKjbJxTYRCj+PUP3MqUNb0kjYk0VkwS3Y9aaWa4RQMHGGUYFIHE7Bo8sBnpO3T6flJv90+N/1QFF2BlZX/p5/PsP5KWJd12ZnAP4OpnWbKMw3trbPAfm7xxhg0r9w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781006885; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=Hl4Phc/SGptDlD9wvlzfeMrOBpaGLDvn8OL4eByCY20=; b=RnwpO4QhMROiuuAMIzal/lG5ltMKuakhu4ry4tZ/+cCETcVf8CArwWIkB/6XPkX2F7i04RcBcqDNq5Qh9WVHX82B0XCGAJsB/1Yz19IDYW0R9G5MtLGvjNuaX9Hc3KJXQCMxdbchkY9ZD/cYLPq/39C/j2I8vHwT1UP/g1Er1XA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1781006884; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=Hl4Phc/SGptDlD9wvlzfeMrOBpaGLDvn8OL4eByCY20=; b=s2KyggbRXZGxJcpacfd2pWuE/oyCJ9j1WdLgEtXPp/yY/IYpQJA9Jn7CrYaiBZg5 NmWVG4hb6LxQYNn9d/qMscNSHpbfx/Brvbw2gUyPgllcmlA83HRMufne3OzRPPbW6Nb vNO7U+MnxXBfuKOPUwk1qaOTNnyiSfrBLI1hCVQg= Received: by mx.zohomail.com with SMTPS id 1781006883104423.15836000045647; Tue, 9 Jun 2026 05:08:03 -0700 (PDT) From: Li Chen To: Pankaj Gupta , Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , Alison Schofield , virtualization@lists.linux.dev, nvdimm@lists.linux.dev Cc: linux-kernel@vger.kernel.org, Li Chen Subject: [PATCH v4 4/7] nvdimm: virtio_pmem: use READ_ONCE()/WRITE_ONCE() for wait flags Date: Tue, 9 Jun 2026 20:07:18 +0800 Message-ID: <20260609120726.1714780-5-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260609120726.1714780-1-me@linux.beauty> References: <20260609120726.1714780-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" Use READ_ONCE()/WRITE_ONCE() for the wait_event() flags (done and wq_buf_avail). They are observed by waiters without pmem_lock, so make the accesses explicit single loads/stores and avoid compiler reordering/caching across the wait/wake paths. Signed-off-by: Li Chen --- v2->v3: - Split out READ_ONCE()/WRITE_ONCE() updates from patch 3/7 (no functional change intended). v3->v4: - Rebased onto v7.1-rc7 and renumbered after the flush error patches. drivers/nvdimm/nd_virtio.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index 16ee5a47b9938..f8c0604edde51 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -18,9 +18,9 @@ static void virtio_pmem_wake_one_waiter(struct virtio_pme= m *vpmem) =20 req_buf =3D list_first_entry(&vpmem->req_list, struct virtio_pmem_request, list); - req_buf->wq_buf_avail =3D true; + list_del_init(&req_buf->list); + WRITE_ONCE(req_buf->wq_buf_avail, true); wake_up(&req_buf->wq_buf); - list_del(&req_buf->list); } =20 /* The interrupt handler */ @@ -34,7 +34,7 @@ void virtio_pmem_host_ack(struct virtqueue *vq) spin_lock_irqsave(&vpmem->pmem_lock, flags); while ((req_data =3D virtqueue_get_buf(vq, &len)) !=3D NULL) { virtio_pmem_wake_one_waiter(vpmem); - req_data->done =3D true; + WRITE_ONCE(req_data->done, true); wake_up(&req_data->host_acked); } spin_unlock_irqrestore(&vpmem->pmem_lock, flags); @@ -66,7 +66,7 @@ static int virtio_pmem_flush(struct nd_region *nd_region) if (!req_data) return -ENOMEM; =20 - req_data->done =3D false; + WRITE_ONCE(req_data->done, false); init_waitqueue_head(&req_data->host_acked); init_waitqueue_head(&req_data->wq_buf); INIT_LIST_HEAD(&req_data->list); @@ -87,12 +87,12 @@ static int virtio_pmem_flush(struct nd_region *nd_regio= n) GFP_ATOMIC)) =3D=3D -ENOSPC) { =20 dev_info(&vdev->dev, "failed to send command to virtio pmem device, no f= ree slots in the virtqueue\n"); - req_data->wq_buf_avail =3D false; + WRITE_ONCE(req_data->wq_buf_avail, false); list_add_tail(&req_data->list, &vpmem->req_list); spin_unlock_irqrestore(&vpmem->pmem_lock, flags); =20 /* A host response results in "host_ack" getting called */ - wait_event(req_data->wq_buf, req_data->wq_buf_avail); + wait_event(req_data->wq_buf, READ_ONCE(req_data->wq_buf_avail)); spin_lock_irqsave(&vpmem->pmem_lock, flags); } err1 =3D virtqueue_kick(vpmem->req_vq); @@ -106,7 +106,7 @@ static int virtio_pmem_flush(struct nd_region *nd_regio= n) err =3D -EIO; } else { /* A host response results in "host_ack" getting called */ - wait_event(req_data->host_acked, req_data->done); + wait_event(req_data->host_acked, READ_ONCE(req_data->done)); err =3D le32_to_cpu(req_data->resp.ret); } =20 --=20 2.52.0 From nobody Thu Jun 11 05:50:53 2026 Received: from sender4-op-o15.zoho.com (sender4-op-o15.zoho.com [136.143.188.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9BDB540F8E4; Tue, 9 Jun 2026 12:08:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.15 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006925; cv=pass; b=Yi6EAgnAMYvBEA3a9/yE0HfNy7ms8K99LUnxqX+8SYP2u1XpeDK0WtXQWYTJzEbWRHqeQoc6IQ0rNDRmU2gtWAarocozn2oc//3FcXBY4C8QptWM2dFUjvjuUWu5ao379AHfZRBAcAwdl3EGI3zkEVp1QzIcWd34/qD+JlawaVw= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006925; c=relaxed/simple; bh=KdJG4zRHuVbedneI0eAEw61H+V+L8AZzIyer0jQRuWE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=QIb20wp66tNT/1jTJZo6Cmxl5w13kcrfJ7A6XWBR0LoSyyln4U2EDfwsgIohbhSR+JiL7Oq8jh+PcZgute5NCQX4/ZKG4/lOLfvdyU+GDqoXPnqT3vnfGYugof+5dnQOwY/QYIE67ysnhQMDCpFSRtvNdqmFWGMKRvxdm9aBrNo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=rxWxu2TX; arc=pass smtp.client-ip=136.143.188.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="rxWxu2TX" ARC-Seal: i=1; a=rsa-sha256; t=1781006891; cv=none; d=zohomail.com; s=zohoarc; b=G3NQ5tkhefxcgbR+fc5HttRlHEJU4pArvi5XB1B7YgOXYtZR5Fu6C0UDmbpny/pWIil0w2elQTSkWAJ5yiTEOBnfSsTw8Xbn1U6KaMS6evfQoAeRf6GcXf707FCgqrp3Rtu/PztVdYoVr6U4pdDw+WpeWws0I5xTG+ZLnAY5sqU= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781006891; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=GXAoC5zKyTc3h2xhSbceB5qyRcnqM5DC0tBvQYicLqI=; b=WHcXK8eOs8TNiNCWQ9+p/LcpqhUzInthRhsiFLNVw23V6MqojZDRekI7aYBL25LJZWtQRxrFFi5bRqotDHTiGLmMYYCO73NV15nKohrVvJJuWs03W4bAs4+G/EWxEeFO9Lf3jxZieVqBrf0neZQDxcJjmEbZW71zLmp0K1tp1oY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1781006891; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=GXAoC5zKyTc3h2xhSbceB5qyRcnqM5DC0tBvQYicLqI=; b=rxWxu2TXAejLijEy/DzfNMO6h+Ax7DGheaTK4ht+myrGOAozX8N/ez6DPZM2epLN e0jnTbHGYVwXpikoTuqhlj61I+pTPNmxNq1Nac5eEiDhTHDHVF9x5NOS7o/xJ94oxzg MpiaCtj3OElTnm3HgfzA72o6SaDlQtWX8sg9Qviw= Received: by mx.zohomail.com with SMTPS id 1781006887616405.8886096625614; Tue, 9 Jun 2026 05:08:07 -0700 (PDT) From: Li Chen To: Pankaj Gupta , Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , Alison Schofield , virtualization@lists.linux.dev, nvdimm@lists.linux.dev Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, Li Chen Subject: [PATCH v4 5/7] nvdimm: virtio_pmem: refcount requests for token lifetime Date: Tue, 9 Jun 2026 20:07:19 +0800 Message-ID: <20260609120726.1714780-6-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260609120726.1714780-1-me@linux.beauty> References: <20260609120726.1714780-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" KASAN reports slab-use-after-free in __wake_up_common(): BUG: KASAN: slab-use-after-free in __wake_up_common+0x114/0x160 Read of size 8 at addr ffff88810fdcb710 by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.19.0-next-20260220-00006-g1eae5f204ec3 #4 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Arch Linux 1.17.0-2-2 04/01/2014 Call Trace: dump_stack_lvl+0x6d/0xb0 print_report+0x170/0x4e2 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __virt_addr_valid+0x1dc/0x380 kasan_report+0xbc/0xf0 ? __wake_up_common+0x114/0x160 ? __wake_up_common+0x114/0x160 __wake_up_common+0x114/0x160 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 __wake_up+0x36/0x60 virtio_pmem_host_ack+0x11d/0x3b0 ? sched_balance_domains+0x29f/0xb00 ? __pfx_virtio_pmem_host_ack+0x10/0x10 ? _raw_spin_lock_irqsave+0x98/0x100 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 vring_interrupt+0x1c9/0x5e0 ? __pfx_vp_interrupt+0x10/0x10 vp_vring_interrupt+0x87/0x100 ? __pfx_vp_interrupt+0x10/0x10 __handle_irq_event_percpu+0x17f/0x550 ? __pfx__raw_spin_lock+0x10/0x10 handle_irq_event+0xab/0x1c0 handle_fasteoi_irq+0x276/0xae0 __common_interrupt+0x65/0x130 common_interrupt+0x78/0xa0 virtio_pmem_host_ack() wakes a request that has already been freed by the submitter. This happens when the request token is still reachable via the virtqueue, but virtio_pmem_flush() returns and frees it. Fix the token lifetime by refcounting struct virtio_pmem_request. virtio_pmem_flush() holds a submitter reference, and the virtqueue holds an extra reference once the request is queued. The completion path drops the virtqueue reference, and the submitter drops its reference before returning. Fixes: 6e84200c0a29 ("virtio-pmem: Add virtio pmem driver") Cc: stable@vger.kernel.org Signed-off-by: Li Chen --- v2->v3: - Add raw KASAN report to the patch description. - Drop timestamps from the embedded report. v3->v4: - Rebased onto v7.1-rc7 and renumbered after the flush error patches. drivers/nvdimm/nd_virtio.c | 34 +++++++++++++++++++++++++++++----- drivers/nvdimm/virtio_pmem.h | 2 ++ 2 files changed, 31 insertions(+), 5 deletions(-) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index f8c0604edde51..f5264f6afe44f 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -9,6 +9,14 @@ #include "virtio_pmem.h" #include "nd.h" =20 +static void virtio_pmem_req_release(struct kref *kref) +{ + struct virtio_pmem_request *req; + + req =3D container_of(kref, struct virtio_pmem_request, kref); + kfree(req); +} + static void virtio_pmem_wake_one_waiter(struct virtio_pmem *vpmem) { struct virtio_pmem_request *req_buf; @@ -36,6 +44,7 @@ void virtio_pmem_host_ack(struct virtqueue *vq) virtio_pmem_wake_one_waiter(vpmem); WRITE_ONCE(req_data->done, true); wake_up(&req_data->host_acked); + kref_put(&req_data->kref, virtio_pmem_req_release); } spin_unlock_irqrestore(&vpmem->pmem_lock, flags); } @@ -66,6 +75,7 @@ static int virtio_pmem_flush(struct nd_region *nd_region) if (!req_data) return -ENOMEM; =20 + kref_init(&req_data->kref); WRITE_ONCE(req_data->done, false); init_waitqueue_head(&req_data->host_acked); init_waitqueue_head(&req_data->wq_buf); @@ -83,10 +93,23 @@ static int virtio_pmem_flush(struct nd_region *nd_regio= n) * to req_list and wait for host_ack to wake us up when free * slots are available. */ - while ((err =3D virtqueue_add_sgs(vpmem->req_vq, sgs, 1, 1, req_data, - GFP_ATOMIC)) =3D=3D -ENOSPC) { - - dev_info(&vdev->dev, "failed to send command to virtio pmem device, no f= ree slots in the virtqueue\n"); + for (;;) { + err =3D virtqueue_add_sgs(vpmem->req_vq, sgs, 1, 1, req_data, + GFP_ATOMIC); + if (!err) { + /* + * Take the virtqueue reference while @pmem_lock is + * held so completion cannot run concurrently. + */ + kref_get(&req_data->kref); + break; + } + + if (err !=3D -ENOSPC) + break; + + dev_info_ratelimited(&vdev->dev, + "failed to send command to virtio pmem device, no free slots in t= he virtqueue\n"); WRITE_ONCE(req_data->wq_buf_avail, false); list_add_tail(&req_data->list, &vpmem->req_list); spin_unlock_irqrestore(&vpmem->pmem_lock, flags); @@ -95,6 +118,7 @@ static int virtio_pmem_flush(struct nd_region *nd_region) wait_event(req_data->wq_buf, READ_ONCE(req_data->wq_buf_avail)); spin_lock_irqsave(&vpmem->pmem_lock, flags); } + err1 =3D virtqueue_kick(vpmem->req_vq); spin_unlock_irqrestore(&vpmem->pmem_lock, flags); /* @@ -110,7 +134,7 @@ static int virtio_pmem_flush(struct nd_region *nd_regio= n) err =3D le32_to_cpu(req_data->resp.ret); } =20 - kfree(req_data); + kref_put(&req_data->kref, virtio_pmem_req_release); return err; }; =20 diff --git a/drivers/nvdimm/virtio_pmem.h b/drivers/nvdimm/virtio_pmem.h index f72cf17f9518f..1017e498c9b4c 100644 --- a/drivers/nvdimm/virtio_pmem.h +++ b/drivers/nvdimm/virtio_pmem.h @@ -12,11 +12,13 @@ =20 #include #include +#include #include #include #include =20 struct virtio_pmem_request { + struct kref kref; struct virtio_pmem_req req; struct virtio_pmem_resp resp; =20 --=20 2.52.0 From nobody Thu Jun 11 05:50:53 2026 Received: from sender4-op-o15.zoho.com (sender4-op-o15.zoho.com [136.143.188.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 305981DE4EF for ; Tue, 9 Jun 2026 12:08:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.15 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006942; cv=pass; b=M68Rm9P9K2k18o6OHwGhk1EmigGLl60Sp9A7dFWGRNbgyjpf4qOIZ1oz3wRlD+FveBWVPF7R1Eivoxm8Ya81hX5yYz/pHOVqL/3wW0LQN04qXCScQjL3AMxJFqwA4Qkt8o2kLvZ6L6N9hlJMquO+8icIXZvrR3vnARs+g3dyfD4= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006942; c=relaxed/simple; bh=MOBpxf2KPfjKQaDSVDN3EfDN5cmBmtOx1n5j+18cJQo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=CtgZJZIPFcKvPnafY5FBhKe/vL8G1OLa2NgDEnkPQ7Fe4F2NGXGCzmJFX+1f9caxQfWISDZgIz6O1ef+53wh2RAu1aEWrUQyfEsi7S2kCnjV59dxqPYSEZ4r7sYKl2U0sjXlts0Rk8S5h/ZoP7/nLeLcROZPYsxSNot1XiODeZU= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=fD4tk0b3; arc=pass smtp.client-ip=136.143.188.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="fD4tk0b3" ARC-Seal: i=1; a=rsa-sha256; t=1781006895; cv=none; d=zohomail.com; s=zohoarc; b=YAoxGrw1Fq0aYINDgqxV4mOPkAdP9aALQsUT3jtTCxn6NJqjM3A9vRnOrL7jstYn74/yH3ZUNYU0q0m8KXquxvoUvjUYFBGAIt1Gvqz8Ez3H72cVEhzcnQhmBRsFDg94g5lRmNDIVhl2VGuICqi4iyiyhWPquRAgi7UXtQcDAaY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781006895; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=+VKpqbNodhGE24ruoy0eBPqZYA9HkHZDJMI9RXBu+6I=; b=M5CyUA5Bo/4XgvhjqPNQZvR8KagOx5QbS+cDl1TmSQVVkENUPPWmMN/atNB6Q2+LYeffTbFTEsJpYXcuzZgIOMtDrtfKpo5lA+319Wi20HutIPJ1VTlxThD8tpBHKabHEVof2tGp2NwuZIFM9c38veIZ+jOM/8O8T4FQ4JM0CXA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1781006895; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=+VKpqbNodhGE24ruoy0eBPqZYA9HkHZDJMI9RXBu+6I=; b=fD4tk0b38QIfei4YA3fiPz/5/FnNUJUsf99UFy3FX518bKQfd7oeX0Zrc9ERr7RH uQzjspjKtK3oM9/xp5+HbC6r7soR2vZ8sIxqDePFoYToh96iu1aYVmZyNQ5X5MDcWHk ivXXyWMFvmXUg554eVOjV8JhCJtcOtaJptwzSqTU= Received: by mx.zohomail.com with SMTPS id 1781006891808110.5663496236458; Tue, 9 Jun 2026 05:08:11 -0700 (PDT) From: Li Chen To: Pankaj Gupta , Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , Alison Schofield , virtualization@lists.linux.dev, nvdimm@lists.linux.dev Cc: linux-kernel@vger.kernel.org, Li Chen Subject: [PATCH v4 6/7] nvdimm: virtio_pmem: converge broken virtqueue to -EIO Date: Tue, 9 Jun 2026 20:07:20 +0800 Message-ID: <20260609120726.1714780-7-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260609120726.1714780-1-me@linux.beauty> References: <20260609120726.1714780-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" dmesg reports virtqueue failure and device reset: virtio_pmem virtio2: failed to send command to virtio pmem device, no free slots in the virtqueue virtio_pmem virtio2: virtio pmem device needs a reset virtio_pmem_flush() waits for either a free virtqueue descriptor (-ENOSPC) or a host completion. If the request virtqueue becomes broken (e.g. virtqueue_kick() notify failure), those waiters may never make progress. Track a device-level broken state and converge all error paths to -EIO. Fail fast for new requests, wake all -ENOSPC waiters, and drain/detach outstanding request tokens to complete them with an error. Closes: https://lore.kernel.org/r/202512250116.ewtzlD0g-lkp@intel.com/ Signed-off-by: Li Chen --- v2->v3: - Add raw dmesg excerpt to the patch description. - Drop timestamps from the embedded dmesg. - Fold the CONFIG_VIRTIO_PMEM=3Dm export fix into this patch. v3->v4: - Rebased onto v7.1-rc7 and renumbered after the flush error patches. - Use kmalloc_obj(*req_data) at the allocation site to match current nvdimm code. drivers/nvdimm/nd_virtio.c | 76 +++++++++++++++++++++++++++++++++--- drivers/nvdimm/virtio_pmem.c | 7 ++++ drivers/nvdimm/virtio_pmem.h | 4 ++ 3 files changed, 81 insertions(+), 6 deletions(-) diff --git a/drivers/nvdimm/nd_virtio.c b/drivers/nvdimm/nd_virtio.c index f5264f6afe44f..3f13e234e2f04 100644 --- a/drivers/nvdimm/nd_virtio.c +++ b/drivers/nvdimm/nd_virtio.c @@ -17,6 +17,18 @@ static void virtio_pmem_req_release(struct kref *kref) kfree(req); } =20 +static void virtio_pmem_signal_done(struct virtio_pmem_request *req) +{ + WRITE_ONCE(req->done, true); + wake_up(&req->host_acked); +} + +static void virtio_pmem_complete_err(struct virtio_pmem_request *req) +{ + req->resp.ret =3D cpu_to_le32(1); + virtio_pmem_signal_done(req); +} + static void virtio_pmem_wake_one_waiter(struct virtio_pmem *vpmem) { struct virtio_pmem_request *req_buf; @@ -31,6 +43,41 @@ static void virtio_pmem_wake_one_waiter(struct virtio_pm= em *vpmem) wake_up(&req_buf->wq_buf); } =20 +static void virtio_pmem_wake_all_waiters(struct virtio_pmem *vpmem) +{ + struct virtio_pmem_request *req, *tmp; + + list_for_each_entry_safe(req, tmp, &vpmem->req_list, list) { + WRITE_ONCE(req->wq_buf_avail, true); + wake_up(&req->wq_buf); + list_del_init(&req->list); + } +} + +void virtio_pmem_mark_broken_and_drain(struct virtio_pmem *vpmem) +{ + struct virtio_pmem_request *req; + unsigned int len; + + if (READ_ONCE(vpmem->broken)) + return; + + WRITE_ONCE(vpmem->broken, true); + dev_err_once(&vpmem->vdev->dev, "virtqueue is broken\n"); + virtio_pmem_wake_all_waiters(vpmem); + + while ((req =3D virtqueue_get_buf(vpmem->req_vq, &len)) !=3D NULL) { + virtio_pmem_complete_err(req); + kref_put(&req->kref, virtio_pmem_req_release); + } + + while ((req =3D virtqueue_detach_unused_buf(vpmem->req_vq)) !=3D NULL) { + virtio_pmem_complete_err(req); + kref_put(&req->kref, virtio_pmem_req_release); + } +} +EXPORT_SYMBOL_GPL(virtio_pmem_mark_broken_and_drain); + /* The interrupt handler */ void virtio_pmem_host_ack(struct virtqueue *vq) { @@ -42,8 +89,7 @@ void virtio_pmem_host_ack(struct virtqueue *vq) spin_lock_irqsave(&vpmem->pmem_lock, flags); while ((req_data =3D virtqueue_get_buf(vq, &len)) !=3D NULL) { virtio_pmem_wake_one_waiter(vpmem); - WRITE_ONCE(req_data->done, true); - wake_up(&req_data->host_acked); + virtio_pmem_signal_done(req_data); kref_put(&req_data->kref, virtio_pmem_req_release); } spin_unlock_irqrestore(&vpmem->pmem_lock, flags); @@ -71,6 +117,9 @@ static int virtio_pmem_flush(struct nd_region *nd_region) return -EIO; } =20 + if (READ_ONCE(vpmem->broken)) + return -EIO; + req_data =3D kmalloc_obj(*req_data); if (!req_data) return -ENOMEM; @@ -115,22 +164,37 @@ static int virtio_pmem_flush(struct nd_region *nd_reg= ion) spin_unlock_irqrestore(&vpmem->pmem_lock, flags); =20 /* A host response results in "host_ack" getting called */ - wait_event(req_data->wq_buf, READ_ONCE(req_data->wq_buf_avail)); + wait_event(req_data->wq_buf, + READ_ONCE(req_data->wq_buf_avail) || + READ_ONCE(vpmem->broken)); spin_lock_irqsave(&vpmem->pmem_lock, flags); + + if (READ_ONCE(vpmem->broken)) + break; } =20 - err1 =3D virtqueue_kick(vpmem->req_vq); + if (err =3D=3D -EIO || virtqueue_is_broken(vpmem->req_vq)) + virtio_pmem_mark_broken_and_drain(vpmem); + + err1 =3D true; + if (!err && !READ_ONCE(vpmem->broken)) { + err1 =3D virtqueue_kick(vpmem->req_vq); + if (!err1) + virtio_pmem_mark_broken_and_drain(vpmem); + } spin_unlock_irqrestore(&vpmem->pmem_lock, flags); /* * virtqueue_add_sgs failed with error different than -ENOSPC, we can't * do anything about that. */ - if (err || !err1) { + if (READ_ONCE(vpmem->broken) || err || !err1) { dev_info(&vdev->dev, "failed to send command to virtio pmem device\n"); err =3D -EIO; } else { /* A host response results in "host_ack" getting called */ - wait_event(req_data->host_acked, READ_ONCE(req_data->done)); + wait_event(req_data->host_acked, + READ_ONCE(req_data->done) || + READ_ONCE(vpmem->broken)); err =3D le32_to_cpu(req_data->resp.ret); } =20 diff --git a/drivers/nvdimm/virtio_pmem.c b/drivers/nvdimm/virtio_pmem.c index 77b1966619059..c5caf11a479a7 100644 --- a/drivers/nvdimm/virtio_pmem.c +++ b/drivers/nvdimm/virtio_pmem.c @@ -25,6 +25,7 @@ static int init_vq(struct virtio_pmem *vpmem) =20 spin_lock_init(&vpmem->pmem_lock); INIT_LIST_HEAD(&vpmem->req_list); + WRITE_ONCE(vpmem->broken, false); =20 return 0; }; @@ -138,6 +139,12 @@ static int virtio_pmem_probe(struct virtio_device *vde= v) static void virtio_pmem_remove(struct virtio_device *vdev) { struct nvdimm_bus *nvdimm_bus =3D dev_get_drvdata(&vdev->dev); + struct virtio_pmem *vpmem =3D vdev->priv; + unsigned long flags; + + spin_lock_irqsave(&vpmem->pmem_lock, flags); + virtio_pmem_mark_broken_and_drain(vpmem); + spin_unlock_irqrestore(&vpmem->pmem_lock, flags); =20 nvdimm_bus_unregister(nvdimm_bus); vdev->config->del_vqs(vdev); diff --git a/drivers/nvdimm/virtio_pmem.h b/drivers/nvdimm/virtio_pmem.h index 1017e498c9b4c..e1a46abb9483c 100644 --- a/drivers/nvdimm/virtio_pmem.h +++ b/drivers/nvdimm/virtio_pmem.h @@ -48,6 +48,9 @@ struct virtio_pmem { /* List to store deferred work if virtqueue is full */ struct list_head req_list; =20 + /* Fail fast and wake waiters if the request virtqueue is broken. */ + bool broken; + /* Synchronize virtqueue data */ spinlock_t pmem_lock; =20 @@ -57,5 +60,6 @@ struct virtio_pmem { }; =20 void virtio_pmem_host_ack(struct virtqueue *vq); +void virtio_pmem_mark_broken_and_drain(struct virtio_pmem *vpmem); int async_pmem_flush(struct nd_region *nd_region, struct bio *bio); #endif --=20 2.52.0 From nobody Thu Jun 11 05:50:53 2026 Received: from sender4-op-o15.zoho.com (sender4-op-o15.zoho.com [136.143.188.15]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4C6F39A048 for ; Tue, 9 Jun 2026 12:09:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=pass smtp.client-ip=136.143.188.15 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006947; cv=pass; b=Q/W22fYPCi4GumQ/5BR67gQoCGEca0nyr6Wr568XcFpV2pcru7ISywQhINRLXrbqyWoz9UpXuuaZyU8kbWAXhcPxAM+xhpEZc7RCPa/i+bxmVtkk0TBLqdt8n9TZqI+wfpMg4bwidax7pRFg9dTKVIpDJFX4IbsCB+kwq9mIyuY= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781006947; c=relaxed/simple; bh=bn3S0f6hh68X/Oaw8Hh6vZHSDp7Cai9WzOE3QKPHnYg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=IaILCIU1ZalZL2d1N0D10IY6f2zLgI59xzhcGqQVaSNpAoHDEF6ur2s864C0tbFzAiCLA/quIk86LemM8VG6cl3nf01wuD5vNhsmFoWQqu6zveEvF1Tl8I2aWuI7P3QObYwsNbyfIIzJAJwGYiTdGK1tP9lJSvftZieE3pBKT60= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty; spf=pass smtp.mailfrom=linux.beauty; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b=JTAYfqlu; arc=pass smtp.client-ip=136.143.188.15 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.beauty Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.beauty Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.beauty header.i=me@linux.beauty header.b="JTAYfqlu" ARC-Seal: i=1; a=rsa-sha256; t=1781006899; cv=none; d=zohomail.com; s=zohoarc; b=AfKYjOQgbxwfglBIKNPmi1ko/0vOSrZe7WyU2RBVBT6QDI0s31UGmdnZmwK+rku/I3f4P78fOpl8K8ERRs2m96R1P2aTcWsZVo/kMQk0VOCFgx+bXhh8wm4xjzMXRXXk6i0ozsFE7Q6nFu7XaDmIMyEA1Kv+XaK0qFv13g9T6j4= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1781006899; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:In-Reply-To:MIME-Version:Message-ID:References:Subject:Subject:To:To:Message-Id:Reply-To; bh=7ESR/E7bBpudii+D5llqF8/d9qpr/9CdW0jpPzvDoGM=; b=dE/cB2ZW3IUbkH9OnhgOshoRUPSbEWAX3AqMMKmX7sUgj4X/tfnd2i3ZkCaxAarTzVucE39xTYNY+enhrQlUYRqtfDbGgJsbD3Epd+4GB/jgMkgTb3GTuCCvXwoDBJTjayA/bTFz1MempvGHCCTgM+5X/yD1/TUidDZZOyIkjsA= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass header.i=linux.beauty; spf=pass smtp.mailfrom=me@linux.beauty; dmarc=pass header.from= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; t=1781006899; s=zmail; d=linux.beauty; i=me@linux.beauty; h=From:From:To:To:Cc:Cc:Subject:Subject:Date:Date:Message-ID:In-Reply-To:References:MIME-Version:Content-Transfer-Encoding:Message-Id:Reply-To; bh=7ESR/E7bBpudii+D5llqF8/d9qpr/9CdW0jpPzvDoGM=; b=JTAYfqluJbzbRgalGDvPptxn3DDcOZO6QiLMBas8aqncxyhTO/no17Ohqom6wDDn 4Qv6skxLNu5szEayRPim75a43rtdrW38AaLLtg7X2yLct5akS/kNAf1fR1EcpLBJQ7W MqcxZ/dCV9gMBab0A7ecs0G3xlVAGvPPvoM9K0Wg= Received: by mx.zohomail.com with SMTPS id 1781006896109750.373420175094; Tue, 9 Jun 2026 05:08:16 -0700 (PDT) From: Li Chen To: Pankaj Gupta , Dan Williams , Vishal Verma , Dave Jiang , Ira Weiny , Alison Schofield , virtualization@lists.linux.dev, nvdimm@lists.linux.dev Cc: linux-kernel@vger.kernel.org, Li Chen Subject: [PATCH v4 7/7] nvdimm: virtio_pmem: drain requests in freeze Date: Tue, 9 Jun 2026 20:07:21 +0800 Message-ID: <20260609120726.1714780-8-me@linux.beauty> X-Mailer: git-send-email 2.52.0 In-Reply-To: <20260609120726.1714780-1-me@linux.beauty> References: <20260609120726.1714780-1-me@linux.beauty> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMailClient: External Content-Type: text/plain; charset="utf-8" virtio_pmem_freeze() deletes virtqueues and resets the device without waking threads waiting for a virtqueue descriptor or a host completion. Mark the request virtqueue broken and drain outstanding requests under pmem_lock before teardown so waiters can make progress and return -EIO. Signed-off-by: Li Chen --- v2->v3: - No change. v3->v4: - Rebased onto v7.1-rc7 and renumbered after the flush error patches. drivers/nvdimm/virtio_pmem.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/nvdimm/virtio_pmem.c b/drivers/nvdimm/virtio_pmem.c index c5caf11a479a7..663a60686fbdb 100644 --- a/drivers/nvdimm/virtio_pmem.c +++ b/drivers/nvdimm/virtio_pmem.c @@ -153,6 +153,13 @@ static void virtio_pmem_remove(struct virtio_device *v= dev) =20 static int virtio_pmem_freeze(struct virtio_device *vdev) { + struct virtio_pmem *vpmem =3D vdev->priv; + unsigned long flags; + + spin_lock_irqsave(&vpmem->pmem_lock, flags); + virtio_pmem_mark_broken_and_drain(vpmem); + spin_unlock_irqrestore(&vpmem->pmem_lock, flags); + vdev->config->del_vqs(vdev); virtio_reset_device(vdev); =20 --=20 2.52.0