From: "Michael S. Tsirkin"<mst@redhat.com>
Date:  Mon, Mar 2, 2026, 16:52
Subject:  [PATCH RFC] vhost: fix vhost_get_avail_idx for a non empty ring
To: <redacted>
Cc: "ShuangYu"<redacted>, "Stefano Garzarella"<sgarzare@redhat.com>, "Stefan Hajnoczi"<stefanha@redhat.com>, "Jason Wang"<jasowang@redhat.com>, "Eugenio Pérez"<eperezma@redhat.com>, <redacted>, <redacted>, <redacted>
vhost_get_avail_idx is supposed to report whether it has updated
vq->avail_idx. Instead, it returns whether all entries have been
consumed, which is usually the same. But not always - in
drivers/vhost/net.c and when mergeable buffers have been enabled, the
driver checks whether the combined entries are big enough to store an
incoming packet. If not, the driver re-enables notifications with
available entries still in the ring. The incorrect return value from
vhost_get_avail_idx propagates through vhost_enable_notify and causes
the host to livelock if the guest is not making progress, as vhost will
immediately disable notifications and retry using the available entries.

The obvious fix is to make vhost_get_avail_idx do what the comment
says it does and report whether new entries have been added.

Reported-by: ShuangYu <redacted>
Fixes: d3bb267bbdcb ("vhost: cache avail index in vhost_enable_notify()")
Cc: Stefano Garzarella <sgarzare@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---

Lightly tested, posting early to simplify testing for the reporter.

 drivers/vhost/vhost.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 2f2c45d20883..db329a6f6145 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c

@@ -1522,6 +1522,7 @@ static void vhost_dev_unlock_vqs(struct vhost_dev *d)

 static inline int vhost_get_avail_idx(struct vhost_virtqueue *vq)
 {
         __virtio16 idx;
+        u16 avail_idx;
         int r;
 
         r = vhost_get_avail(vq, idx, &vq->avail->idx);

@@ -1532,17 +1533,19 @@ static inline int vhost_get_avail_idx(struct vhost_virtqueue *vq)

         }
 
         /* Check it isn't doing very strange thing with available indexes */
-        vq->avail_idx = vhost16_to_cpu(vq, idx);
-        if (unlikely((u16)(vq->avail_idx - vq->last_avail_idx) > vq->num)) {
+        avail_idx = vhost16_to_cpu(vq, idx);
+        if (unlikely((u16)(avail_idx - vq->last_avail_idx) > vq->num)) {
                 vq_err(vq, "Invalid available index change from %u to %u",
-                       vq->last_avail_idx, vq->avail_idx);
+                       vq->last_avail_idx, avail_idx);
                 return -EINVAL;
         }
 
         /* We're done if there is nothing new */
-        if (vq->avail_idx == vq->last_avail_idx)
+        if (avail_idx == vq->avail_idx)
                 return 0;
 
+        vq->avail_idx = avail_idx;
+
         /*
          * We updated vq->avail_idx so we need a memory barrier between
          * the index read above and the caller reading avail ring entries.
-- 
MST