vhost_scsi_send_evt() is called with the event virtqueue mutex held. If the worker is gone, the fallback currently calls vhost_scsi_complete_events(), which tries to acquire the same mutex again and deadlocks the caller.
Split event completion into a helper for callers that already hold the mutex and a locking wrapper for the event worker. Use the helper on the fallback path. Link: https://lore.kernel.org/all/[email protected]/ Fixes: b1b2ce58ed23 ("vhost-scsi: Handle vhost_vq_work_queue failures for events") Signed-off-by: Jia Jia <[email protected]> --- Sashiko AI flagged this while reviewing the vhost-scsi event queue fix. This is a pre-existing self-deadlock. It was reproduced in a follow-up test. Trigger: vq->worker == NULL. vhost_vq_work_queue() then returns false, and a subsequent vhost_scsi_do_plug() call deadlocks. I do not know what normal condition gets us here; the normal vhost-scsi worker detach/reset paths do not reach this code. The only reproduction I could come up with was killing the vhost-scsi worker. This still looks like a low-probability condition. drivers/vhost/scsi.c | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c index 7a1f39a32..7c905e9ad 100644 --- a/drivers/vhost/scsi.c +++ b/drivers/vhost/scsi.c @@ -630,19 +630,26 @@ vhost_scsi_do_evt_work(struct vhost_scsi *vs, struct vhost_scsi_evt *evt) vhost_scsi_log_write(vq, vq_log, log_num); } -static void vhost_scsi_complete_events(struct vhost_scsi *vs, bool drop) +/* Caller must hold the event virtqueue mutex. */ +static void __vhost_scsi_complete_events(struct vhost_scsi *vs, bool drop) { - struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq; struct vhost_scsi_evt *evt, *t; struct llist_node *llnode; - mutex_lock(&vq->mutex); llnode = llist_del_all(&vs->vs_event_list); llist_for_each_entry_safe(evt, t, llnode, list) { if (!drop) vhost_scsi_do_evt_work(vs, evt); vhost_scsi_free_evt(vs, evt); } +} + +static void vhost_scsi_complete_events(struct vhost_scsi *vs, bool drop) +{ + struct vhost_virtqueue *vq = &vs->vqs[VHOST_SCSI_VQ_EVT].vq; + + mutex_lock(&vq->mutex); + __vhost_scsi_complete_events(vs, drop); mutex_unlock(&vq->mutex); } @@ -1829,7 +1836,7 @@ vhost_scsi_send_evt(struct vhost_scsi *vs, struct vhost_virtqueue *vq, llist_add(&evt->list, &vs->vs_event_list); if (!vhost_vq_work_queue(vq, &vs->vs_event_work)) - vhost_scsi_complete_events(vs, true); + __vhost_scsi_complete_events(vs, true); } static void vhost_scsi_evt_handle_kick(struct vhost_work *work)
