From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from OSPPR02CU001.outbound.protection.outlook.com (mail-norwayeastazon11023116.outbound.protection.outlook.com [40.107.159.116]) by lore.virtuozzo.com (Postfix) with ESMTPS id 39F1E802A5 for ; Fri, 2 Oct 2026 11:14:46 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=VEbTqMe2ub/G1GO8cTzpe8zAhjziXOf7blh+ds89tSikEqtOOESdy2jzhAAGTBmr8UvT8gERYKsP1h+I+SlZalav0FPuXGHikwNHK/mz8xfwFtm3ReJZ4fp4M47VbT9Ku8EQsV9JczT0M3Wkx2/FaeoMK+Xzob5iEvbjb9uTFhkKQBv4wACs40993KRIRCJNiS50/xBYakBuM9IEGgFnGtURbPbfZtlUnLv3kdksl6m88nc4NDiCPM4MuAPRktNFylvGIggRvYbkzkYoyv+MaAgsJxIp7KnDRl34RCUb3gRN5QAVtkQPWSMlC3/46uQoXJz6o4rCFX1miFmXzTfY5A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Mpbz7XUgMgakpEzD5DA1gJveIE+0SwX/3SCL5ehlOv0=; b=qUydhxqNIc6jmgIA7gBEB7UqU7JDbppOhIV9xVWSCK0swB3coL/fL3e1BnE90NndYQFNpGNCBg0J/alIsQuWWPms+8bFd+p2y8bYTsi61eLP+Jp+7gGyQGtW7Ph6STrx4ekTA91Pri4LimvJKoOZNS5GJ8oFBP5Qq4M/2WJVairoRiEndG2Up5FrP5vTClFEz2o0aLQBhJ8O3c2XRv374skk4aYNCRYB5OiCqmPtHq4cVejOWsgysBl8hByM0rq+BP0h1qqKy4UM/AhWVIezwkIGP1IZoli+yrLxtCJMkEwqrIznGen96P2TOb3zKdoJ8MKtdeVePEcK4MbbLTCvtA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Mpbz7XUgMgakpEzD5DA1gJveIE+0SwX/3SCL5ehlOv0=; b=APm01Em+qtyL940Z6UBJs5XSxt7Wizl5rOELXUAPSMjuif/FnnfmA/SotY092DhasWUGisrcbvZ8Z5X7SadKLDUuioPanFXfFrIw+astpCWSSWgFuZKGkkTjVvtRjAnQoDxR9B7rWcSXR1U07PHmlkwwiJRbVDaLCyhpXHbBmxan2NlbV5+pjA4a1RO5yLU42v0r8qNqpKH7HRkuqFDufD7d+zgcVpTrbwEjB4gD64UljhOxlfhxq13wF/N0kKX6Vb14JOwFtYlRRs9L2nZQoLzez1pJVGytlvsE8HC1tvSnVf6lY80BwQyz3R/f9AB849C7HLj/yQkCIV9J4OnB3A== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) by VI0PR08MB10390.eurprd08.prod.outlook.com (2603:10a6:800:207::6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.451.18; Fri, 2 Oct 2026 11:14:42 +0000 Received: from VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8]) by VI0PR08MB10656.eurprd08.prod.outlook.com ([fe80::4e37:b189:ddcd:3dd8%7]) with mapi id 15.21.0472.012; Fri, 2 Oct 2026 11:14:42 +0000 Message-ID: Date: Fri, 2 Oct 2026 14:14:41 +0300 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH hci-8.0 1/1] hw/scsi: avoid deadlock upon TMF request cancelling with VirtIO #VSTOR-148264 To: "Denis V. Lunev" , svt-core@virtuozzo.com Cc: den@virtuozzo.com References: <20261002105811.1830637-1-den@openvz.org> Content-Language: en-US From: Andrey Drobyshev In-Reply-To: <20261002105811.1830637-1-den@openvz.org> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-ClientProxiedBy: ZR0P278CA0038.CHEP278.PROD.OUTLOOK.COM (2603:10a6:910:1d::7) To VI0PR08MB10656.eurprd08.prod.outlook.com (2603:10a6:800:20a::12) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: VI0PR08MB10656:EE_|VI0PR08MB10390:EE_ X-MS-Office365-Filtering-Correlation-Id: 5de5e234-e014-47bf-dc3c-08df20765ba7 X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|366016|376014|1800799024|56012099006|18002099003|10067099003|22082099003|5113699003; X-Microsoft-Antispam-Message-Info: 2IonOpWArEeGOS3ucK+F73KVD8MHFLQxf5YNMqVq7uoNfIhyP9zjq+MzQkib2kLc+M1+KSEG6A+dzS20w8F8DcR8190LPUEX81qyPCegj1sh6YQ/9rbFHWu0hYY862UC6I/nw6FAYZ6Ls8D7L7D6bF30S0xnXlACIMNtsVSu17uWtbxB5XyPv2g6EHdN9wc71IzMbzEn3eRti1sRDFIYOe5seEYiEDxNG8rbXJ/yycLPcAjhi8f9i2V8hodAvtW11S3TDkOr62VMea/abZ7M5XmqrsY5Ov74YeqPkYB90xE7dt+GhDXSdIa9gzr/FIfjXyhZ4KRieZWZ1qKHtDb4wdR2HQbj49rcCW6LJoz57iCs29jJbNEYYxYFnmtfwdcmbDp/TKLW/5Tzn0URkaULiryi0iOve+nb+/3bMP9dDZw8OX914cWQVSHK8bvbTTnF+gGC4mYgyxqi6pUJ9cUcT2t7feWYn6wcm9HvsBJITS9hPQjgWsSNlXYhvOX0bnLkV0aiklMSIwWpL6Hqw5riwMXoHuWmqNh8jjynmK2PzdoV35CrTMLRsBH6LdneTC0tEFivLzotPXrlN+dsIiV746MTON2OLRZZ51zYeVrsDaqnIArjVtl01HT6xZvzhuSe X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:VI0PR08MB10656.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(366016)(376014)(1800799024)(56012099006)(18002099003)(10067099003)(22082099003)(5113699003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?YkI3eGZZZEtsUzY5NEY4WHhLZGZMSHB3b1FtcTFwQ0JwNlRpcmxVYkpTdFJX?= =?utf-8?B?MkExeHJyUkJDbkJrQVpqUzU2Y014eXdYNkc5VGNjQk1RNFJ1cmFCRVZpSXNB?= =?utf-8?B?aWZTTzh0c05oY3QxSjdwclJDU3p5TWN0NWVneXVMcWlZRE4rdUV3WEEwU21w?= =?utf-8?B?VVVlT0RtcUNxWGtpZEE4R3l0NVQ0SFBuMWFCM2JuVFlDSW5wRDMrQWt1dWg1?= =?utf-8?B?Tnp4b01zV1ZHOWNiUGZ0WGNFWm5FZjJVSTJibG5Rd3MzUDVoYUhrZHBhWG9n?= =?utf-8?B?Q2JSOS9QNkJpOTVLeU5KcGprZ2cwUGcyUTVpejBYZUVOYkpKTjhsaHNiQ1dv?= =?utf-8?B?aTgrak4ySW9BcXpPNkZpMXlXenhKUUZVZTlFaUZQelJzZjVzaHQzNWV2S1M1?= =?utf-8?B?RFgwVkUrM05vZk4zSytnVUlvV203MEVZdnIyLzhhcko5Skc1NkozQm5pdXpM?= =?utf-8?B?K1RvU09pUHBPSlJhTTJQNHZrQjNVWm0rcE9mYTFrWmFta09jSFVuRzdWdmpl?= =?utf-8?B?K0FjRFhaZ2FFOFpiM292YmNHQUpjamlaYmt3N245VHJrNzlUSHFBS2M4WSs2?= =?utf-8?B?bUQ1WXFYcHBySyszV1NyYWlMR1FVWWlQTDVBWnJhdmVxenBCWS93eTlaVXl5?= =?utf-8?B?K0p0VS9NU2ZYUXNrdGozb0ErZjE1a01vRkJBQm1xYnBqRkV4TlExOEpqUWNL?= =?utf-8?B?S2E4bVN0VU84b2FSa1dYK0tyZFhZd01IUnlocXRYTFE0QnQxZUxWTnNoQUFr?= =?utf-8?B?Z20vSWpYb1ZGOC8yMFpCcnFLcS83QS9pbEZzS1IrTWJDUU53L1R2NDNGaXFM?= =?utf-8?B?ZnE0dUxFZzJ3N2wwcmxXMlVBeDRmYWc4Z05YN2E2NEs4NWVxUUpyYTFSZFli?= =?utf-8?B?MHVaaVdsN1ZVaHRyZ1FzNUJpL2Rydi9sNG1QZWNrUnJ5REZtcm9YbjlzU0RH?= =?utf-8?B?NjVRazlTWEdOUUMwODFZK0pMZWNubWJIMDRsYU9vVVV6N0lrTEpqSDIwcWFx?= =?utf-8?B?ZW1vSkdSSGs4ZnZkdkNXM2diU1N3ak0xc0JoeTVHeEtmMU9tbEpWaUhmQk02?= =?utf-8?B?VU8ydkhzNkdISGphakdqK2tYQWNkRjk5NVNZTm04U2Zzbm05K2tTdU1SQ3hn?= =?utf-8?B?eVpCZjE2RjA4dWFUdmx4TXJGREZOa0x5dW4xYzYrWThqQXE2THdSbDdBaWta?= =?utf-8?B?L1NFOVkxL0ZKNFVweEgyZ1pYdFRYWFBrblhCVU5aLytyWEhwZFoxNTk1eDdn?= =?utf-8?B?Mjh6K3VBRk9CcTdWWXN5a2RMcDQ1cFgwdHp6ak8ybXVFWGR2dDZLRTJ1Znhh?= =?utf-8?B?ZWxPN2JTS0VwZUZMbEZkaURDbXFkTk45My9SKzlOV1lxNlZiUldVdVpjL255?= =?utf-8?B?RmE1SjdEOFBUbU5wTmt0UTBJK2lHbUFDbzYvdkFNdUEvZWJSb05KV1MvSVd5?= =?utf-8?B?aVAyZ2xDa1hNVmw3SUI5OWZUNWxPSEJJUGh2MEhYTVB4SFdmWVZNU0ZScHE1?= =?utf-8?B?MUtlOFdrdUdUenMxVFVNemViMno5Wmp3cHN0bTNsZkhxNmVKU01hNWVwcmw0?= =?utf-8?B?NnFYNWxsaEZaWEJ3YTNCaklCNU9GTGRuZlNWVXhTNis2Z3RGdmZzbVd5ek1x?= =?utf-8?B?Z1NZZjlKTFFVWUZyYVZ4N2VkbG1jc0RSbFliRU84WFBLQ1AzSTVuR1BkREZr?= =?utf-8?B?SFI2VEgydFU0ZGpybmRlanJxVU9TalNCNm5HZnlyZzUzUld1VnRkRUlGakow?= =?utf-8?B?SmVTUml0NjBNT1J0SEZyeVRlYlhFSHhDTkNOLzNUQ05ickM0ODhDekV1cTYv?= =?utf-8?B?NFhUclVkL01kOVQwTmh4MjN6OGcrdk0vREFBdWFzRTQ3VHV6T3V0ZWhaL2JF?= =?utf-8?B?Z25SMTgrZXdvV2RCRW9VNzZUNk85aWpmKzdYKytQUGFlZE11UDRwZ3hMdHlW?= =?utf-8?B?T0t0Sjd3R0hYZTNIckJOVngweWhKbDBndGVyQ1RFQU5sTWErdWFxTUlEcThq?= =?utf-8?B?WHlmMmNEdktCd0d4bjhDMUVEdVh0dWgrUGJGM1dSRHliSTU4UmRudjF5MWQz?= =?utf-8?B?ajl1ZUw5UUUrck1MaURFYnhLUzZ2T2xHamtIV2llRk42TFhhYVVJOUZBM3lC?= =?utf-8?B?Tit0U3FselFiaVMwOUg4RTh1K2JEZnVxZHFnNWgyQ0xXazFvWDkwZllDWEN4?= =?utf-8?B?Z0hkdzhMVXJLTEJHR1RwV0JRK3Znd1VGY0RlNjNRdCtQWEx5dlppZ0Y3T2V0?= =?utf-8?B?SFFTaUt0YVNtdnA5YmEzcTdtT0JDOUdqaTUxQ2dSdW5RaXNCaGVsODNWTTMy?= =?utf-8?B?dlFpT20xYmIyelkxRm5WNFJCYkNaU25uY0F1ZVRveEFJWXhybFhSeVFNWFRT?= =?utf-8?Q?NJf7f3nUH+Faypmo=3D?= X-Auto-Response-Suppress: DR, OOF, AutoReply X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 5de5e234-e014-47bf-dc3c-08df20765ba7 X-MS-Exchange-CrossTenant-AuthSource: VI0PR08MB10656.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 02 Oct 2026 11:14:42.7519 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 3EvEy/FpnHJsrUTRni82m+mPQ+twhIuRQHnweXvq/Wr9ROYQULxybmJY6OQQhRrYeOCnM9axQRj+30P2UMJM8R3o2exHHYWbTa5sQ8fB+WY= X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI0PR08MB10390 Ack Applied to hci-8.0 On 10/2/26 1:58 PM, Denis V. Lunev wrote: > From: Fiona Ebner > > When scsi_req_dequeue() is reached via > scsi_req_cancel_async() > virtio_scsi_tmf_cancel_req() > virtio_scsi_do_tmf_aio_context(), > there is a deadlock when trying to acquire the SCSI device's requests > lock, because it was already acquired in > virtio_scsi_do_tmf_aio_context(). > > In particular, the issue happens with a FreeBSD guest (13, 14, 15, > maybe more), when it cancels SCSI requests, because of timeout. > > This is a regression caused by commit da6eebb33b ("virtio-scsi: > perform TMFs in appropriate AioContexts") and the introduction of the > requests_lock earlier. > > To fix the issue, only cancel the requests after releasing the > requests_lock. For this, the SCSI device's requests are iterated while > holding the requests_lock and the requests to be cancelled are > collected in a list. Then, the collected requests are cancelled > one by one while not holding the requests_lock. This is safe, because > only requests from the current AioContext are collected and acted > upon. > > Originally reported by Proxmox VE users: > https://bugzilla.proxmox.com/show_bug.cgi?id=6810 > https://forum.proxmox.com/threads/173914/ > > Fixes: da6eebb33b ("virtio-scsi: perform TMFs in appropriate AioContexts") > Suggested-by: Stefan Hajnoczi > Signed-off-by: Fiona Ebner > Message-id: 20251017094518.328905-1-f.ebner@proxmox.com > [Changed g_list_append() to g_list_prepend() to avoid traversing the > list each time. > --Stefan] > Signed-off-by: Stefan Hajnoczi > (cherry picked from commit 6910f04aa646f63a0257f77201ad8ea15992b816) > Signed-off-by: Michael Tokarev > (cherry picked from commit dfd597681092ba72c2c050cd0aa1d80a87822804) > --- > hw/scsi/virtio-scsi.c | 14 +++++++++++++- > 1 file changed, 13 insertions(+), 1 deletion(-) > > diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c > index 34ae14f7bf9..3b635053b56 100644 > --- a/hw/scsi/virtio-scsi.c > +++ b/hw/scsi/virtio-scsi.c > @@ -343,6 +343,7 @@ static void virtio_scsi_do_tmf_aio_context(void *opaque) > SCSIDevice *d = virtio_scsi_device_get(s, tmf->req.tmf.lun); > SCSIRequest *r; > bool match_tag; > + g_autoptr(GList) reqs = NULL; > > if (!d) { > tmf->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET; > @@ -378,10 +379,21 @@ static void virtio_scsi_do_tmf_aio_context(void *opaque) > if (match_tag && cmd_req->req.cmd.tag != tmf->req.tmf.tag) { > continue; > } > - virtio_scsi_tmf_cancel_req(tmf, r); > + /* > + * Cannot cancel directly, because scsi_req_dequeue() would deadlock > + * when attempting to acquire the request_lock a second time. Taking > + * a reference here is paired with an unref after cancelling below. > + */ > + scsi_req_ref(r); > + reqs = g_list_prepend(reqs, r); > } > } > > + for (GList *elem = g_list_first(reqs); elem; elem = g_list_next(elem)) { > + virtio_scsi_tmf_cancel_req(tmf, elem->data); > + scsi_req_unref(elem->data); > + } > + > /* Incremented by virtio_scsi_do_tmf() */ > virtio_scsi_tmf_dec_remaining(tmf); >