From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8CDF23E0C68 for ; Mon, 2 Mar 2026 14:31:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772461866; cv=none; b=oM1Z6VhgzKb9IIl9PwdMzmkvcwuDoDBWs2NR1QAbo0XYhMi5EtWu76Aa4EUIyBsS50e4xS6j65D0oVk1sfNMG3U5n9Q+742tEWs6IDugAW5jrLlR+f7BLEGTt7JJCs7SCSSpQhTyvEsE291HUdc/YDFBynMgEdDYyIEL8xk6smQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772461866; c=relaxed/simple; bh=tu6vW5JzAvAhrtnD0Orm8DgWyEhTriU4R1yaRjCyZQc=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=GwDxU3bt5ymxLT0IpkjkUREz2D8Xx376thuV1Zb7OS0uqBSyXL50eqj4/lUUREApSaC+sPu18oRHEpJJQKC54EN0f9CKFQml7wDx+ceqWtaXt4tm/ZNIhYTfmtSOniKAYCLMQsfdMj0cfxmXopAtJDpzzdpXx0vRGWmiisgL60I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=FOMo/0SW; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=qnFcY04Q; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="FOMo/0SW"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="qnFcY04Q" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1772461864; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=SKZvtx1jQH7FuclJfSavk4MXL11q6SiX0sIanHFtIBI=; b=FOMo/0SWrxVbghAOHZMptVK13+Y0e7xsTsV8DeeSt2FX3pg4vQeSV/MpHKrIZxvE2OzXBq KFhTsRyP7KrMgZoq0NxNX9A/3iZUgU2O8HnH8iFQBlTSlwW0obmjkThAmzMhQtWJk95zPL 4xLVebMK4P1C19/wtcfu61gFUEuRUeU= Received: from mail-wm1-f71.google.com (mail-wm1-f71.google.com [209.85.128.71]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-442-m18gEu9ROnuXoD4mFmoxyA-1; Mon, 02 Mar 2026 09:31:03 -0500 X-MC-Unique: m18gEu9ROnuXoD4mFmoxyA-1 X-Mimecast-MFC-AGG-ID: m18gEu9ROnuXoD4mFmoxyA_1772461862 Received: by mail-wm1-f71.google.com with SMTP id 5b1f17b1804b1-483101623e9so42293565e9.3 for ; Mon, 02 Mar 2026 06:31:03 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1772461862; x=1773066662; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=SKZvtx1jQH7FuclJfSavk4MXL11q6SiX0sIanHFtIBI=; b=qnFcY04QZhtGR/Q79DN22LxyPSlJMCrxEGWYhXtPkaiY1vh7Y9c6rBygQM/CDxsQIX 3i60swndx7rl3Qk6IUbhIckBLiwkOVlpweZiLr45Jpx2+7tITucbxrfNgoHlhztRFmHK kmWoXXVk7ClcBqvKY+Jt0bFsIkUStT+j40hamsbo9e7Kmxh1tROXFruxzfC4+BNjvA6x 2HYQyduwO/VpocpHyRj1puBnN8IX+0eYxEPjHXixYKxyLbv/cIf8HRW29sYdEPL+3wrX Ek7SnU16GQD6LEhOJf+5qjYsKo8SupWV6SroRzE6tGFgXjYn0mVcHV5c60OJzBEX3nCI VBZQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772461862; x=1773066662; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=SKZvtx1jQH7FuclJfSavk4MXL11q6SiX0sIanHFtIBI=; b=A/03kc3zT8D5v3QFLrHp8ZsiDv7xB3X0gzniNZNZsCGRoJXj8o8x58f1M+5DOBanIJ P0eRdeRDVe54IufCl0M0DMJf8eapWy8zlGIkJxdI74mIiQ7t/PCBqqPL4VXWBlqFbnHV PP2m7iWyujAF1k0X6jxAP+bLpiuI6PIEQqEs9UesIX1XEAKSYIHGddvlWC7gMGk7u8Fk Kg+pwqvdv/ldQzSIS+80vGA7OPvijaLTZ5hmz9C2nuFA3KI7sFNx1GcpCY2D56BAeZRK 7oUq54GEVWNEdIzSerMnaowZ13G7/4MFYqYqKjmsjDBnHzEqzd5sfZgeEHHgzzlMhWu3 D7bQ== X-Gm-Message-State: AOJu0YzlVyAJW4HRiAiiftK6tc7cUuV7QpAkAUSMiwM0C9f42vg1nmgv 0uZLw/SEBCERkYMgnoRbP6b3FShT31DgJCr01eRcUM8pDeMJI1zlqfMtnlnJq0QM9G5hLHyCMKI mWy1/lrdK85tfVKxh7IgwbdtwuuFifOqjlk6lecMAfYknQpoJUCyq9k1nDjaJvDK6KQ== X-Gm-Gg: ATEYQzxKsnm8YPYeN4htzv0xLEyDcLj2ztkpjILLuAXQUof5CNdgWpLlNd/fLK8uaaC DeqAJdMcU+xPH6Gl9wwOzSdAhuDvRSq3bLBEboJ1marwBCaw5IbjCfxwRx/DfZAkTkVGWAuk+Wn HLWLOWG+LriP57wjvHO8P25ygA7XHS6GZVoHSXQqxU0lHGhm3/MYWWU9tjq36bECnm0Wbx8XIfN O7ZU4OtVzkSXOk6k44mlB76ChN6RaKfDePsIThMgyIDvaP918VArb8WHQoYvMPG1AV1bPt698qu BDcsTV8ePSRKGnE4zD/2EkQxmR1mZF3jblH1V+T32aCcq3xPHGgnl+ON1Aji5NWS3Vm/byAR+NM jnKD6/7ydb2WiOAIjE+0TPRTL88AW6T7jK6MkE4TUNe6I1mH49y1y/IHdSiCHzVRH6RVfTb4= X-Received: by 2002:a05:600c:64c7:b0:47d:73a4:45a7 with SMTP id 5b1f17b1804b1-483c9c19a6emr218449415e9.24.1772461862154; Mon, 02 Mar 2026 06:31:02 -0800 (PST) X-Received: by 2002:a05:600c:64c7:b0:47d:73a4:45a7 with SMTP id 5b1f17b1804b1-483c9c19a6emr218448515e9.24.1772461861478; Mon, 02 Mar 2026 06:31:01 -0800 (PST) Received: from sgarzare-redhat (host-82-53-134-58.retail.telecomitalia.it. [82.53.134.58]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-483bfcb318fsm206220415e9.6.2026.03.02.06.30.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 02 Mar 2026 06:31:00 -0800 (PST) Date: Mon, 2 Mar 2026 15:30:53 +0100 From: Stefano Garzarella To: "Michael S. Tsirkin" Cc: linux-kernel@vger.kernel.org, ShuangYu , Stefan Hajnoczi , Jason Wang , Eugenio =?utf-8?B?UMOpcmV6?= , kvm@vger.kernel.org, virtualization@lists.linux.dev, netdev@vger.kernel.org Subject: Re: [PATCH RFC] vhost: fix vhost_get_avail_idx for a non empty ring Message-ID: References: <559b04ae6ce52973c535dc47e461638b7f4c3d63.1772441455.git.mst@redhat.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Disposition: inline In-Reply-To: <559b04ae6ce52973c535dc47e461638b7f4c3d63.1772441455.git.mst@redhat.com> On Mon, Mar 02, 2026 at 03:51:49AM -0500, Michael S. Tsirkin wrote: >vhost_get_avail_idx is supposed to report whether it has updated >vq->avail_idx. Instead, it returns whether all entries have been >consumed, which is usually the same. But not always - in >drivers/vhost/net.c and when mergeable buffers have been enabled, the >driver checks whether the combined entries are big enough to store an >incoming packet. If not, the driver re-enables notifications with >available entries still in the ring. The incorrect return value from >vhost_get_avail_idx propagates through vhost_enable_notify and causes >the host to livelock if the guest is not making progress, as vhost will >immediately disable notifications and retry using the available entries. Here I'd add something like this just to make it clear the full picture, because I spent quite some time to understand how it was related to the Fixes tag (which I agree is the right one to use). This goes back to commit d3bb267bbdcb ("vhost: cache avail index in vhost_enable_notify()") which changed vhost_enable_notify() to compare the freshly read avail index against vq->last_avail_idx instead of the previously cached vq->avail_idx. Commit 7ad472397667 ("vhost: move smp_rmb() into vhost_get_avail_idx()") then carried over the same comparison when refactoring vhost_enable_notify() to call the unified vhost_get_avail_idx(). > >The obvious fix is to make vhost_get_avail_idx do what the comment >says it does and report whether new entries have been added. > >Reported-by: ShuangYu >Fixes: d3bb267bbdcb ("vhost: cache avail index in vhost_enable_notify()") >Cc: Stefano Garzarella >Cc: Stefan Hajnoczi >Signed-off-by: Michael S. Tsirkin >--- > >Lightly tested, posting early to simplify testing for the reporter. Tested with vhost-vsock and I didn't see any issue. Thanks! Reviewed-by: Stefano Garzarella > > drivers/vhost/vhost.c | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > >diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c >index 2f2c45d20883..db329a6f6145 100644 >--- a/drivers/vhost/vhost.c >+++ b/drivers/vhost/vhost.c >@@ -1522,6 +1522,7 @@ static void vhost_dev_unlock_vqs(struct vhost_dev *d) > static inline int vhost_get_avail_idx(struct vhost_virtqueue *vq) > { > __virtio16 idx; >+ u16 avail_idx; > int r; > > r = vhost_get_avail(vq, idx, &vq->avail->idx); >@@ -1532,17 +1533,19 @@ static inline int vhost_get_avail_idx(struct vhost_virtqueue *vq) > } > > /* Check it isn't doing very strange thing with available indexes */ >- vq->avail_idx = vhost16_to_cpu(vq, idx); >- if (unlikely((u16)(vq->avail_idx - vq->last_avail_idx) > vq->num)) { >+ avail_idx = vhost16_to_cpu(vq, idx); >+ if (unlikely((u16)(avail_idx - vq->last_avail_idx) > vq->num)) { > vq_err(vq, "Invalid available index change from %u to %u", >- vq->last_avail_idx, vq->avail_idx); >+ vq->last_avail_idx, avail_idx); > return -EINVAL; > } > > /* We're done if there is nothing new */ >- if (vq->avail_idx == vq->last_avail_idx) >+ if (avail_idx == vq->avail_idx) > return 0; > >+ vq->avail_idx = avail_idx; >+ > /* > * We updated vq->avail_idx so we need a memory barrier between > * the index read above and the caller reading avail ring entries. >-- >MST >