@samitouri / QOSamiQemu / commits / 6864bec553

block/linux-aio: bound ioq_submit() recursion depth

qemu_laio_process_completions() wraps its body in defer_call_begin / defer_call_end. Inside the section, completion callbacks wake coroutines that queue new aiocbs; laio_do_submit() defers laio_deferred_fn. At the bottom of qemu_laio_process_completions() the defer_call_end() fires laio_deferred_fn, which calls ioq_submit(), closing the cycle: ioq_submit -> io_submit(2) // some sync completions -> qemu_laio_process_completions // defer_call_begin -> aio_co_wake // resumes coroutine -> laio_do_submit -> defer_call(laio_deferred_fn, s) // enqueued -> defer_call_end // nesting drops to 0 -> laio_deferred_fn -> ioq_submit // +1 stack frame, loop When io_submit(2) returns asynchronously (O_DIRECT) the cycle terminates in one extra frame: the fresh aiocb is still in flight, no completion is drained, no coroutine wakes, no new submission queues. When submissions complete synchronously (non-O_DIRECT, or per-descriptor drivers such as vmdk) each level enqueues more work for the next defer_call_end() to drain, so recursion grows without bound and QEMU crashes with SIGSEGV on the thread guard page. The cycle was closed by two performance commits, each correct in isolation: 076682885d ("block/linux-aio: convert to blk_io_plug_call() API") -- introduced laio_deferred_fn and wired laio_do_submit -> defer_call(laio_deferred_fn, s). 84d61e5f36 ("virtio: use defer_call() in virtio_irqfd_notify()") -- added defer_call_begin/end around qemu_laio_process_completions so virtio-irqfd notifications batch across a completion pass. The supported aio=native + cache=none pairing keeps submissions asynchronous, so the cycle stays bounded; nothing in the code enforces that contract. Observed in production as a SIGSEGV during a backup job configured with --cached + aio=native; reproducible on upstream with qemu-io against vmdk. Cap ioq_submit() recursion with a counter on LaioQueue, which is only accessed from the AioContext home thread. On overflow, return without submitting. The pending work is drained by s->completion_bh, which qemu_laio_process_completions() has already scheduled on entry -- no work is lost; one event-loop round-trip of latency is paid only when the bound is hit, which cannot happen on a supported configuration. Signed-off-by: Denis V. Lunev <den@openvz.org> CC: Kevin Wolf <kwolf@redhat.com> CC: Hanna Reitz <hreitz@redhat.com> CC: Stefan Hajnoczi <stefanha@redhat.com> CC: Paolo Bonzini <pbonzini@redhat.com> Message-ID: <20260520142503.251959-2-den@openvz.org> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>

Denis V. Lunev committed May 20, 2026 at 16:25 UTC 6864bec553b2e37699739615e604fc3c7bae0e1d

1 file changed +22

block/linux-aio.c

+22

@@ -36,6 +36,19 @@

36 /* Maximum number of requests in a batch. (default value) */

37 #define DEFAULT_MAX_BATCH 32

39 +/*

40 + * Bound on how deep ioq_submit() may recurse on a single LaioQueue via the

41 + * ioq_submit -> qemu_laio_process_completions -> defer_call_end ->

42 + * laio_deferred_fn -> ioq_submit cycle. The cycle terminates naturally

43 + * when io_submit(2) returns asynchronously (O_DIRECT), but can grow

44 + * without bound when submissions complete synchronously. On overflow

45 + * the caller returns without submitting; the outermost

46 + * qemu_laio_process_completions() has already scheduled s->completion_bh

47 + * (via qemu_bh_schedule() at the top of that function), which resumes

48 + * submission from the next event-loop dispatch.

49 + */

50 +#define IOQ_SUBMIT_MAX_DEPTH 8

51 +

52 struct qemu_laiocb {

53 Coroutine *co;

54 LinuxAioState *ctx;

@@ -61,6 +74,7 @@ typedef struct {

74 unsigned int in_queue;

75 unsigned int in_flight;

76 bool blocked;

77 + unsigned int submit_depth;

78 QSIMPLEQ_HEAD(, qemu_laiocb) pending;

79 } LaioQueue;

@@ -331,6 +345,7 @@ static void ioq_init(LaioQueue *io_q)

345 io_q->in_queue = 0;

346 io_q->in_flight = 0;

347 io_q->blocked = false;

348 + io_q->submit_depth = 0;

349 }

350

351 static void ioq_submit(LinuxAioState *s)

@@ -340,6 +355,11 @@ static void ioq_submit(LinuxAioState *s)

355 QEMU_UNINITIALIZED struct iocb *iocbs[MAX_EVENTS];

356 QSIMPLEQ_HEAD(, qemu_laiocb) completed;

357

358 + if (s->io_q.submit_depth >= IOQ_SUBMIT_MAX_DEPTH) {

359 + return;

360 + }

361 + s->io_q.submit_depth++;

362 +

363 do {

364 if (s->io_q.in_flight >= MAX_EVENTS) {

365 break;

@@ -385,6 +405,8 @@ static void ioq_submit(LinuxAioState *s)

405 * pended requests will be submitted from there.

406 */

407 }

408 +

409 + s->io_q.submit_depth--;

410 }

411

412 static uint64_t laio_max_batch(LinuxAioState *s, uint64_t dev_max_batch)