Re: [PATCH] virtio_ring: use shadow flags when detaching split descriptors

["Michael S. Tsirkin" <mst@redhat.com>]

On Tue, Oct 06, 2026 at 07:04:00PM +0900, sungbyeongchan wrote:
> Split virtqueues save descriptor flags and next indexes in desc_extra
> before publishing descriptors to the device. The detach path uses the
> shadow next index, but decides whether to continue by rereading the NEXT
> flag from the shared descriptor.
> 
> A device can change the flag after publication and make
> detach_buf_split_in_order() detach an adjacent active descriptor. This
> overcounts num_free and may put a descriptor on the free list twice.

This seems neither here nor there I'd drop this paragraph.

> Use the shadow flags for the continuation decision as well. This keeps
> all detach metadata in the same driver-owned snapshot and avoids an
> unnecessary shared-ring read.
> 
> A VDUSE/virtio-vdpa test which changed NEXT after publication made six
> valid completions return seven descriptors, with one descriptor ID
> duplicated on refill. With this change, the same test returned six
> unique descriptors, while the unmodified control remained unchanged.

This too.

> Fixes: 72b5e8958738 ("virtio-ring: store DMA metadata in desc_extra for split virtqueue")
> Assisted-by: LLM
> Signed-off-by: sungbyeongchan <tjdqudcks0424@naver.com>
> ---
>  drivers/virtio/virtio_ring.c | 3 +--
>  1 file changed, 1 insertion(+), 2 deletions(-)


Patch itself is good, I always like it when the # of lines of code
drops)

Acked-by: Michael S. Tsirkin <mst@redhat.com>



> diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
> index db678f5a80e03..b4cb433df1dec 100644
> --- a/drivers/virtio/virtio_ring.c
> +++ b/drivers/virtio/virtio_ring.c
> @@ -905,7 +905,6 @@ static unsigned detach_buf_split_in_order(struct vring_virtqueue *vq,
>  {
>  	struct vring_desc_extra *extra;
>  	unsigned int i;
> -	__virtio16 nextflag = cpu_to_virtio16(vq->vq.vdev, VRING_DESC_F_NEXT);
>  
>  	/* Clear data ptr. */
>  	vq->split.desc_state[head].data = NULL;
> @@ -915,7 +914,7 @@ static unsigned detach_buf_split_in_order(struct vring_virtqueue *vq,
>  	/* Put back on free list: unmap first-level descriptors and find end */
>  	i = head;
>  
> -	while (vq->split.vring.desc[i].flags & nextflag) {
> +	while (extra[i].flags & VRING_DESC_F_NEXT) {
>  		i = vring_unmap_one_split(vq, &extra[i]);
>  		vq->vq.num_free++;
>  	}
> -- 
> 2.43.0