From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from MRWPR03CU001.outbound.protection.outlook.com (mail-francesouthazon11021086.outbound.protection.outlook.com [40.107.130.86]) by lore.virtuozzo.com (Postfix) with ESMTPS id 4EDB7802A7 for ; Fri, 2 Oct 2026 10:58:23 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=bfWy1hmwBmLPiAQ10MR0JVw84m5nrHd76Pgut/0WyS++jF9FCbtb+wXoPFTbUP49PJalQug6T0GnNXsZu7Rd06epzWSE49awuGWmyDaA2sQhVPuGUoZF2vuWxMDFmqCa1rlMaEr3Rc8WdyC/8x/KqoHbIov+b/lQt7vQADDm3WjZv8nLUvspgtNxewgE8UtPQfhMvW1M6gKy18UD1deouO4Hf25GIcNnhyzQTvEHs+yO7P0PtFxPPQ9PRQazg8Qn7FwX/82zRF78vJ8o1Dlm4rIw8msxtAsofYOtapo0GqEPW7826BUTvrTYn/DyIMHYy9u58MGUQynFYwxIp8y9hA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=wtgjuvke4DOZyqQNSoI4otl+umWzZon1IgV8lAg5uro=; b=UFBNho/WiqvWJMvtC0vpqApkQjj7YXCmvCZVtFjxNmVAPci3dHj9z6PbhnbmDgIukgGxeGdlIoM/AukDxBELn5/dyf6+fGht+GoBNnkk4t/EqXQIJgQ/rfgBGAj2Q5+6JInXBmsNsMkXz9nOmRi5H8IqxI5xvFs1tWTDyZiHimAX7Uvm63ZfDgI1lcUNfldu2FPzd2o5pKWX9LfzMv68o2jLdnoZRfQ72IwjC08dAoNZhDN4qPCpIrncqUGTfX0fMXqI5C+yu+oWy/xVH/J1fj5wHBz6xXtw99nhIUmzYoLxo9qXtMJu3Ii4BD1Hh+sCBjXho/G3fMdkAcGqJhEq2A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 2a00:1450:4864:30::f) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=openvz.org; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=openvz.org; dkim=pass (signature was verified) header.d=openvz.org; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=wtgjuvke4DOZyqQNSoI4otl+umWzZon1IgV8lAg5uro=; b=X/a8j9OeNq4g4728Vhy60+jc+zC3KBlf6gh3oHUkiVS2jK4poS03mb4h0RTJzuICcexo520TANIEutZxMVCHt71quoo2Q+Ya4aw5fFDPqW4oMoq/tZU5oQC1xYfNK+EldydZrOPDXAaJRixrVIQszwZJ/W+6uz1zE8BPfBPfvDg= Received: from BE1P281CA0222.DEUP281.PROD.OUTLOOK.COM (2603:10a6:b10:88::15) by DU0PR08MB9582.eurprd08.prod.outlook.com (2603:10a6:10:44a::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.19; Fri, 2 Oct 2026 10:58:17 +0000 Received: from WA1PEPF00009B3E.eurprd05.prod.outlook.com (2603:10a6:b10:88:cafe::4e) by BE1P281CA0222.outlook.office365.com (2603:10a6:b10:88::15) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.18 via Frontend Transport; Fri, 2 Oct 2026 10:58:17 +0000 Authentication-Results: spf=pass (sender IP is 2a00:1450:4864:30::f) smtp.mailfrom=openvz.org; dkim=pass (signature was verified) header.d=openvz.org;dmarc=pass action=none header.from=openvz.org; Received-SPF: Pass (protection.outlook.com: domain of openvz.org designates 2a00:1450:4864:30::f as permitted sender) receiver=protection.outlook.com; client-ip=2a00:1450:4864:30::f; helo=mail-wr2-x0f.google.com; pr=C Received: from mail-wr2-x0f.google.com (2a00:1450:4864:30::f) by WA1PEPF00009B3E.mail.protection.outlook.com (2603:10a6:1d8::117) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.472.14 via Frontend Transport; Fri, 2 Oct 2026 10:58:15 +0000 Received: by mail-wr2-x0f.google.com with SMTP id ffacd0b85a97d-48b09f6bbe8so1048843f8f.1 for ; Fri, 02 Oct 2026 03:58:15 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=openvz.org; s=google; t=1790938695; x=1791543495; darn=virtuozzo.com; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=wtgjuvke4DOZyqQNSoI4otl+umWzZon1IgV8lAg5uro=; b=aSLMrYD70ojtG9D9Z9yTSiu0pZFG5I0r4wTbzaLbmAMUPRMRV5ie9uCugvoWWONGpn N756AQoeKdhurkvpa80CCttIWiOM5q83dEI9iNAIz2PtSRV/CTu74DGsaStDqidINi/k tbyJUPutQURI9NI7DI1xpfm4VQAv6Of0kW69ZwPhMhcy7cjYBpEG6zdj0w+HE39jtDHk Kn0e8oFYQB49BrzDU5fDppT+ZThhr3XAI7ugVks4pjgpHWjfAnI9g1kCuHsAjRkE849D 4QJFcw3mXmI7VaRc2xY3DEOeXz7A1Z/4Bm65iWuvIeFObQn9cnN283kSK8PCXWJRWcVd J/Vg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1790938695; x=1791543495; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=wtgjuvke4DOZyqQNSoI4otl+umWzZon1IgV8lAg5uro=; b=hlhYCLhNpRpoi90DrmmLevMqr+w1T3tlppgRsC585LDiZP55/4hndb1gQKY8oDwtPV OK+qtSYkVNuXiACBUC8ENZCO1JMqEG2S8APeUCBIgs192No3FJxDCeAfl/zMCops3V+U rDUPtHgYS4x/8vVOSKX+PPkxwem7FGHFthmfXNST1IiPZHjW+YldOHGcnSP7m2Xy7TlD /6YaZO2GeryvXzuxuHlAGArSjXtubhzKhdiJ8Pm1hRdbhjGg+azw12VQoFFsLxW+iAYR KbzcrxdSmJGpvWfGqaga28UsKRGZiIDJGF/62hlmbWktqFls6chpSkQW4b3G8E9xr8dz Wy4A== X-Gm-Message-State: AFq9FYKBW4RZD2weDrwPpBWQ/+KVBixviXSGMK2E59mWowduO5MJBG9o uJIbT2Sh7gMUPl/oCmAMH00Zoueax7lgXbIo/HryqcS3Tq4WwokdMCdANWFUaQOxoxsJL/UwUBt jTyJa73M= X-Gm-Gg: AYBFou0YczbV7cnyAlpu0QWILREujXQNfi7Po5GysMNeiFEWKSsl9hidyXzfw2hkoDz LnHXTIa/KZVtiAPKZ5/2pQUWZkA/ozKvfSbLL7cfgprUrk7KwBhYoVyP+rrT23QaIu7olwXlEG3 czELO7C+zTi0iWY4mMF2QfZilFNFyMJ34bKU4LJd6w6VI9xAn7tlizEFpVaKwrWxPFKoEW74pie gQHA2/GLiZq31d+0yNZbB5FQ3kGP3pxTx0TICNUG+8Ly+EmDHNb9d130QCv1RKnIbrH54HVDv1v ttIF8PBcVuqOM1LgruH0MLNDAkS8jUBZfKqJRxfr3g3HZb9q/rAqRq/2VU6od6agpLQqA0QRfWC nfFCST0rT9tr3E3W6k4qD6zKuO6x2650kxA6HQ0Uq8ml4g/yYxqXxiFG7NNkx052s6pDjoXLGGD YV0NO/+NykNfFqulf/vDa1j5p1WG1h9Oq4cX0AAhHfEVTDCCW8m9h62tnoFHyy7ZUJsKc= X-Received: by 2002:a05:6000:4b06:b0:48a:f318:ac02 with SMTP id ffacd0b85a97d-48b1270e876mr4535805f8f.19.1790938694991; Fri, 02 Oct 2026 03:58:14 -0700 (PDT) Received: from athena.sw.ru ([2a06:5b06:b600:300:9f21:a362:21c8:d9a1]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48b380f07a9sm5689955f8f.12.2026.10.02.03.58.13 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 02 Oct 2026 03:58:14 -0700 (PDT) From: "Denis V. Lunev" To: svt-core@virtuozzo.com Cc: andrey.drobyshev@virtuozzo.com, den@virtuozzo.com Subject: [PATCH hci-8.0 1/1] hw/scsi: avoid deadlock upon TMF request cancelling with VirtIO #VSTOR-148264 Date: Fri, 2 Oct 2026 12:58:11 +0200 Message-ID: <20261002105811.1830637-1-den@openvz.org> X-Mailer: git-send-email 2.53.0 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: WA1PEPF00009B3E:EE_|DU0PR08MB9582:EE_ X-MS-Office365-Filtering-Correlation-Id: 1d4edc37-b1ff-4e6b-eb01-08df20740f99 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA X-MS-Exchange-SenderADCheck: 0 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|82310400026|9140799003|48200799018|6059299003|43022699015|376014|61400799027|13003099007|10067099003|5063699009|56012099006|18002099003|55112099003|16102099003; X-Microsoft-Antispam-Message-Info: F1eYp66xTqBs98bNtHmmtmI2ZZFmBuDOjDrfr/+x2IIeHPubkGcFz453UsbxMnE53SQj2WMqtf8/0n2nAEffd9FCNnkprlf4BCVIkyEQzKw4YdjcyqSk03knQjCkhWXqTJLcxbNIvLnKEGQOzE57tc38X0rIEVn7CUSaP/J1c0vaz+jzJpVyqzSlWu1D/YyXS+Bop/swpNg//E6P0nhJhNLieBToEjbknb+m49fIAAYPOY4dXwk1n3IfBxNrAj3DdItWM7jPPgCWYcWypWuZ76rbbvrNBXAPnfsFzC/HcGxy7RDpvFCyfgmMDMxPUGB7A9MV5kNU7KufDePY/llr9M7ci1rl2knhX6pZHFjFOYAUIXfMXUqhNw8YbBdO23SaO8xf661zJ9lICjxxxHUCGkDYSaPicC9s4vonNwYsZwZkgPlshBLx3OUOugXy3MlKC8PMJw6a5q79Tzi7Bsvab6JGnva4paIhf0h7wH0oPO/wSlZdkTzpovAu7Y32duHV1j0fbqH821tnf4y/Yqbj4tRB9h7h+m08RzYq4o0U8wv2ki7W/XsOYUSuQI5qg2CRgbQA6WVU4Hqem0cdY/PffVhInJknTOY1GVbO06s3wx7K4yjiYrFZMiPrCNpiEL2gY4MZYJqFDC2B8ZXzvLLXI4kEB5nCcGA8PEnOLVP/IMDpHcRbXylkZb2jYqVgej6A8KRKFcB6RDnu2UOsEQN8ZUAaPBo/VNZbwkogDfFQQPtVFm1TbYmIW69ilXkW+OfoHfflg3tiKTPxWsZNH8kuXhqixcjwGdeqbEMlLARsn5ZeIB99pODP2lCTKH7fwvhuiC+KT0u10O+jK0hDpDhlpg== X-Forefront-Antispam-Report: CIP:2a00:1450:4864:30::f;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail-wr2-x0f.google.com;PTR:mail-wr2-x0f.google.com;CAT:NONE;SFS:(13230040)(82310400026)(9140799003)(48200799018)(6059299003)(43022699015)(376014)(61400799027)(13003099007)(10067099003)(5063699009)(56012099006)(18002099003)(55112099003)(16102099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: JV5smavFAnoWbZdnZOSy9n8w8dRZUYlga7aUKkr2ym/pZHae3vm/M56SmdOyFKhPKvfiacqjLpIuY1PR240n2i6S3ZZJPA3ynXq06VpDnOLm52cb7s8L2KuqigWSorESR3WGClvpqEe/BabkN17IWbm+ZVuECdf4VC2ZhbVUAYSEBJ/0ojLeVG0R94jLBZSKg/M+lCPTSuplobnL3f2PixvMF18zPLclii4sD6as9X3UKNWllspyw+iCSG8ILJRLaLWp96kbuqNWo1ZRHHjvYW3Z9gSvwLmcP10wHKwTzHrC0A46HjyNDscx/bHHH6OgE9T02rWyZHv3lIz+wxX551xzAY8V9GHO44/jSOdWnWliaVR6zkeqWAx8pl/sg5uJiLM1jZdPf7OQvjRjVufQmgJ6F4o3npa7GRdELSYNESbXpp7Y1wOtOAF19YRCYjlA X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Oct 2026 10:58:15.8157 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 1d4edc37-b1ff-4e6b-eb01-08df20740f99 X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: WA1PEPF00009B3E.eurprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: DU0PR08MB9582 List-Id: From: Fiona Ebner When scsi_req_dequeue() is reached via scsi_req_cancel_async() virtio_scsi_tmf_cancel_req() virtio_scsi_do_tmf_aio_context(), there is a deadlock when trying to acquire the SCSI device's requests lock, because it was already acquired in virtio_scsi_do_tmf_aio_context(). In particular, the issue happens with a FreeBSD guest (13, 14, 15, maybe more), when it cancels SCSI requests, because of timeout. This is a regression caused by commit da6eebb33b ("virtio-scsi: perform TMFs in appropriate AioContexts") and the introduction of the requests_lock earlier. To fix the issue, only cancel the requests after releasing the requests_lock. For this, the SCSI device's requests are iterated while holding the requests_lock and the requests to be cancelled are collected in a list. Then, the collected requests are cancelled one by one while not holding the requests_lock. This is safe, because only requests from the current AioContext are collected and acted upon. Originally reported by Proxmox VE users: https://bugzilla.proxmox.com/show_bug.cgi?id=6810 https://forum.proxmox.com/threads/173914/ Fixes: da6eebb33b ("virtio-scsi: perform TMFs in appropriate AioContexts") Suggested-by: Stefan Hajnoczi Signed-off-by: Fiona Ebner Message-id: 20251017094518.328905-1-f.ebner@proxmox.com [Changed g_list_append() to g_list_prepend() to avoid traversing the list each time. --Stefan] Signed-off-by: Stefan Hajnoczi (cherry picked from commit 6910f04aa646f63a0257f77201ad8ea15992b816) Signed-off-by: Michael Tokarev (cherry picked from commit dfd597681092ba72c2c050cd0aa1d80a87822804) --- hw/scsi/virtio-scsi.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c index 34ae14f7bf9..3b635053b56 100644 --- a/hw/scsi/virtio-scsi.c +++ b/hw/scsi/virtio-scsi.c @@ -343,6 +343,7 @@ static void virtio_scsi_do_tmf_aio_context(void *opaque) SCSIDevice *d = virtio_scsi_device_get(s, tmf->req.tmf.lun); SCSIRequest *r; bool match_tag; + g_autoptr(GList) reqs = NULL; if (!d) { tmf->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET; @@ -378,10 +379,21 @@ static void virtio_scsi_do_tmf_aio_context(void *opaque) if (match_tag && cmd_req->req.cmd.tag != tmf->req.tmf.tag) { continue; } - virtio_scsi_tmf_cancel_req(tmf, r); + /* + * Cannot cancel directly, because scsi_req_dequeue() would deadlock + * when attempting to acquire the request_lock a second time. Taking + * a reference here is paired with an unref after cancelling below. + */ + scsi_req_ref(r); + reqs = g_list_prepend(reqs, r); } } + for (GList *elem = g_list_first(reqs); elem; elem = g_list_next(elem)) { + virtio_scsi_tmf_cancel_req(tmf, elem->data); + scsi_req_unref(elem->data); + } + /* Incremented by virtio_scsi_do_tmf() */ virtio_scsi_tmf_dec_remaining(tmf); -- 2.53.0