virtio_pci_modern: move avq cleanup from reset to del_vqs

vp_modern_avq_cleanup() detaches unused buffers from the admin
virtqueue. Calling it from vp_reset() is incorrect:
virtqueue_get_buf in the avq interrupt handler can race with
virtqueue_detach_unused_buf in cleanup, and get_buf after
detach is not documented as valid.

The root cause is that detaching buffers does not belong in
reset at all - reset quiesces the device, while cleanup belongs
where the virtqueue is about to be destroyed, from del_vqs.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/virtualization/20260911125745.E0A2F1F00899@smtp.kernel.org/
Fixes: 4c3b54af90 ("virtio_pci_modern: use completion instead of busy loop to wait on admin cmd result")
Cc: Jiri Pirko <jiri@resnulli.us>
Assisted-by: LLM
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <21fe35ad7b66e2c30dbdba6fe4df4824d1c0db66.1789204858.git.mst@redhat.com>
This commit is contained in:
Michael S. Tsirkin 2026-09-12 06:30:18 -04:00
parent dd75508e6f
commit 2a12d96dd8

View File

@ -364,6 +364,12 @@ static void vp_modern_avq_cleanup(struct virtio_device *vdev)
}
}
static void vp_modern_del_vqs(struct virtio_device *vdev)
{
vp_modern_avq_cleanup(vdev);
vp_del_vqs(vdev);
}
static void vp_transport_features(struct virtio_device *vdev, u64 features)
{
struct virtio_pci_device *vp_dev = to_vp_device(vdev);
@ -558,8 +564,6 @@ static void vp_reset(struct virtio_device *vdev)
while (vp_modern_get_status(mdev))
msleep(1);
vp_modern_avq_cleanup(vdev);
/* Flush pending VQ/configuration callbacks. */
vp_synchronize_vectors(vdev);
}
@ -1232,7 +1236,7 @@ static const struct virtio_config_ops virtio_pci_config_nodev_ops = {
.set_status = vp_set_status,
.reset = vp_reset,
.find_vqs = vp_modern_find_vqs,
.del_vqs = vp_del_vqs,
.del_vqs = vp_modern_del_vqs,
.synchronize_cbs = vp_synchronize_vectors,
.get_extended_features = vp_get_features,
.finalize_features = vp_finalize_features,
@ -1252,7 +1256,7 @@ static const struct virtio_config_ops virtio_pci_config_ops = {
.set_status = vp_set_status,
.reset = vp_reset,
.find_vqs = vp_modern_find_vqs,
.del_vqs = vp_del_vqs,
.del_vqs = vp_modern_del_vqs,
.synchronize_cbs = vp_synchronize_vectors,
.get_extended_features = vp_get_features,
.finalize_features = vp_finalize_features,