From nobody Sat Jul 25 15:52:31 2026 Received: from canpmsgout02.his.huawei.com (canpmsgout02.his.huawei.com [113.46.200.217]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CA43B41D64B; Thu, 16 Jul 2026 11:59:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.217 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784203189; cv=none; b=F1UL9BskL5n+qzYUl0HS+4qygB/xxC91zyupnCGtKbEK8x4Uet5efNrqExcTY4Lgo/+R1u5YmPTcVQ859YCP3Aeccz8bX9ypdZNuOKZqXKy5Vf+8K5wdzZyLfpKSi5Rii2SiZloKgQ7lUq77cXKVwybTgqGuvU7acjFNYsLS4vA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784203189; c=relaxed/simple; bh=QRH2nCRi2AJcsHgASTiwpMuQqva/K/ZADnblDXPGNxo=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=ZoXSTH6WHuJ8BTLr80xP59EpS4eYpjbzjyiDM865okHr48vGH1/NRX+Eee1/BbNXHRdBURucZNJ9Wg/Co7tSrHzVPwrJwpikOzBb6HtEbJRICzeb9QEoVVM1bsASV2bEk/sz78gmQdbI3dYEWNZ+UlSdT26MifFGNeV8n7VKOoQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=odIo4Y5O; arc=none smtp.client-ip=113.46.200.217 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="odIo4Y5O" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=AzSLZfuT3hZEITMJME2LjKJXE9lnjM46O9KbbYTXnSc=; b=odIo4Y5Oh1uXwkFcktScRbAAsyrrKPtR2lwmkuHIm8BvYXdEgzKVmG/9IQIMXQFNGvmI12V+M WaD6LMTaIXCJNftOAsJ7cLfRFzjMSsfGi3KZrK0wM+sSjg3Ux+kJiUmV31O09rz7TkOZbtxIV8Z gMGTG1iPaAeAH/ZhTs5hWgw= Received: from mail.maildlp.com (unknown [172.19.162.197]) by canpmsgout02.his.huawei.com (SkyGuard) with ESMTPS id 4h1BDw43Xqzcb0m; Thu, 16 Jul 2026 19:50:24 +0800 (CST) Received: from dggpemf500013.china.huawei.com (unknown [7.185.36.188]) by mail.maildlp.com (Postfix) with ESMTPS id 8F6DE4057D; Thu, 16 Jul 2026 19:59:42 +0800 (CST) Received: from huawei.com (10.50.163.32) by dggpemf500013.china.huawei.com (7.185.36.188) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.11; Thu, 16 Jul 2026 19:59:41 +0800 From: Jinqian Yang To: , , , , , , , , CC: , , , , , , Jinqian Yang Subject: [PATCH v3] virtio_ring: fix infinite loop in virtnet_poll_cleantx when device is broken Date: Thu, 16 Jul 2026 19:59:40 +0800 Message-ID: <20260716115940.394832-1-yangjinqian1@huawei.com> X-Mailer: git-send-email 2.33.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: kwepems100002.china.huawei.com (7.221.188.206) To dggpemf500013.china.huawei.com (7.185.36.188) Content-Type: text/plain; charset="utf-8" virtnet_poll_cleantx() contains a do-while loop that cleans up transmitted TX buffers and calls virtqueue_enable_cb_delayed() to check whether more buffers need processing. When the virtio backend stops responding during guest reboot, used->idx is never updated, so virtqueue_enable_cb_delayed() always returns false and the loop never terminates. Then it will block reboot process, and the guest will hang. The problem occurs during guest reboot under network traffic: 1. kernel_restart() -> device_shutdown() traverses the device list 2. virtio_dev_shutdown() calls virtio_break_device() which sets vq->broken =3D true 3. virtio_dev_shutdown() then calls virtio_synchronize_cbs() to wait for in-flight callbacks to complete 4. A virtio interrupt fires, softirq is deferred to ksoftirqd which calls net_rx_action() -> virtnet_poll() -> virtnet_poll_cleantx() 5. virtnet_poll_cleantx() enters the do-while loop and never exits because the QEMU backend has stopped updating used->idx, despite vq->broken having been set to true in step 2. Since the loop runs inside ksoftirqd (a SCHED_OTHER kthread), it is visible to the scheduler and does not trigger a hard lockup. However, the kthread never leaves the loop, so RCU detects it as a CPU stall and reports it periodically. Meanwhile, the reboot process remains blocked in device_shutdown() because virtio_dev_shutdown() cannot complete its synchronization step, and the guest hangs permanently. This can be reproduced on a guest with a virtio-net device: run iperf3 traffic in the guest, then trigger reboot. The reboot occasionally hangs permanently with RCU stall on ksoftirqd. Observed on ARM64 KVM guest: CPU#1 RCU stall (ksoftirqd/1), repeated periodically: virtqueue_enable_cb_delayed_split <- virtnet_poll <- __napi_poll <- net_rx_action <- handle_softirqs <- run_ksoftirqd <- smpboot_thread_fn <- kthread Fix by adding a vq->broken check in virtqueue_enable_cb_delayed(), so that the loop exits immediately when the device is broken, allowing the device shutdown to proceed. Signed-off-by: Jinqian Yang Reviewed-by: Xuan Zhuo --- Changes in v2: - Moved vq->broken check to virtqueue_enable_cb_delayed(). Changes in v3: - Updated the patch subject prefix. v1: https://lore.kernel.org/lkml/20260713132025.703147-1-yangjinqian1@huawe= i.com/ v2: https://lore.kernel.org/lkml/20260716035201.3736582-1-yangjinqian1@huaw= ei.com/ --- drivers/virtio/virtio_ring.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c index b438dc2ce1b8..5c169fbb418a 100644 --- a/drivers/virtio/virtio_ring.c +++ b/drivers/virtio/virtio_ring.c @@ -3233,6 +3233,14 @@ bool virtqueue_enable_cb_delayed(struct virtqueue *_= vq) { struct vring_virtqueue *vq =3D to_vvq(_vq); =20 + /* + * When the device is broken there is no point in polling used->idx, + * the backend will never update it. Return true to let callers + * exit their cleanup loops instead of spinning forever. + */ + if (unlikely(vq->broken)) + return true; + if (vq->event_triggered) data_race(vq->event_triggered =3D false); =20 --=20 2.33.0