Skip to content
Snippets Groups Projects
  • Stefan Hajnoczi's avatar
    cf4fbc30
    block/nvme: fix infinite loop in nvme_free_req_queue_cb() · cf4fbc30
    Stefan Hajnoczi authored
    
    When the request free list is exhausted the coroutine waits on
    q->free_req_queue for the next free request. Whenever a request is
    completed a BH is scheduled to invoke nvme_free_req_queue_cb() and wake
    up waiting coroutines.
    
    1. nvme_get_free_req() waits for a free request:
    
        while (q->free_req_head == -1) {
            ...
                trace_nvme_free_req_queue_wait(q->s, q->index);
                qemu_co_queue_wait(&q->free_req_queue, &q->lock);
            ...
        }
    
    2. nvme_free_req_queue_cb() wakes up the coroutine:
    
        while (qemu_co_enter_next(&q->free_req_queue, &q->lock)) {
           ^--- infinite loop when free_req_head == -1
        }
    
    nvme_free_req_queue_cb() and the coroutine form an infinite loop when
    q->free_req_head == -1. Fix this by checking q->free_req_head in
    nvme_free_req_queue_cb(). If the free request list is exhausted, don't
    wake waiting coroutines. Eventually an in-flight request will complete
    and the BH will be scheduled again, guaranteeing forward progress.
    
    Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
    Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
    Message-id: 20211208152246.244585-1-stefanha@redhat.com
    Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
    cf4fbc30
    History
    block/nvme: fix infinite loop in nvme_free_req_queue_cb()
    Stefan Hajnoczi authored
    
    When the request free list is exhausted the coroutine waits on
    q->free_req_queue for the next free request. Whenever a request is
    completed a BH is scheduled to invoke nvme_free_req_queue_cb() and wake
    up waiting coroutines.
    
    1. nvme_get_free_req() waits for a free request:
    
        while (q->free_req_head == -1) {
            ...
                trace_nvme_free_req_queue_wait(q->s, q->index);
                qemu_co_queue_wait(&q->free_req_queue, &q->lock);
            ...
        }
    
    2. nvme_free_req_queue_cb() wakes up the coroutine:
    
        while (qemu_co_enter_next(&q->free_req_queue, &q->lock)) {
           ^--- infinite loop when free_req_head == -1
        }
    
    nvme_free_req_queue_cb() and the coroutine form an infinite loop when
    q->free_req_head == -1. Fix this by checking q->free_req_head in
    nvme_free_req_queue_cb(). If the free request list is exhausted, don't
    wake waiting coroutines. Eventually an in-flight request will complete
    and the BH will be scheduled again, guaranteeing forward progress.
    
    Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>
    Reviewed-by: default avatarPhilippe Mathieu-Daudé <philmd@redhat.com>
    Message-id: 20211208152246.244585-1-stefanha@redhat.com
    Signed-off-by: default avatarStefan Hajnoczi <stefanha@redhat.com>