From 61e14c8571ab1bc6473721bd465352d8246a8ada Mon Sep 17 00:00:00 2001 From: Sergii Ushakov Date: Mon, 17 Aug 2026 15:42:02 +0200 Subject: [PATCH] virtio-blk: clamp max_segments when indirect descriptors are disabled When VIRTIO_RING_F_INDIRECT_DESC is not negotiated by the host, every scatter-gather segment in a request must consume a physical slot in the virtqueue ring. If the host does not advertise VIRTIO_BLK_F_SEG_MAX and provides a small virtqueue (e.g. 128 descriptors on QNX Hypervisor), the block layer defaults max_segments to BLK_MAX_SEGMENTS (1024). When a multi-page compound bio arrives from the page cache, virtqueue_add_split() rejects the request with -ENOSPC and triggers: WARNING: at drivers/virtio/virtio_ring.c:1493 virtqueue_add+... WARN_ON_ONCE(total_sg > vq->split.vring.num && !vq->indirect); This permanently wedges the blk-mq queue and blocks all subsequent disk I/O in uninterruptible sleep (D state). Automatically clamp sg_elems to (ring_size - 2) when indirect descriptors are disabled. Signed-off-by: Sergii Ushakov Reviewed-by: Stefan Hajnoczi Reviewed-by: Christoph Hellwig --- drivers/block/virtio_blk.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c index 32bf3ba07a9dc..8f5a2d5323a66 100644 --- a/drivers/block/virtio_blk.c +++ b/drivers/block/virtio_blk.c @@ -1267,6 +1267,13 @@ static int virtblk_read_limits(struct virtio_blk *vblk, /* Prevent integer overflows and honor max vq size */ sg_elems = min_t(u32, sg_elems, VIRTIO_BLK_MAX_SG_ELEMS - 2); + if (!virtio_has_feature(vdev, VIRTIO_RING_F_INDIRECT_DESC)) { + u32 ring_size = virtqueue_get_vring_size(vblk->vqs[0].vq); + + if (ring_size > 2) + sg_elems = min(sg_elems, ring_size - 2); + } + /* We can handle whatever the host told us to handle. */ lim->max_segments = sg_elems;