On Fri, Mar 20, 2026 at 11:38:48AM +0100, Laurent Vivier wrote:
> When vu_queue_pop() succeeds but the element contains no out buffers,
> we warn and break out of the TX loop.  However, vu_queue_pop() already
> incremented vq->inuse for this element.  Since we don't add it to the
> count of elements to be filled and flushed back to the guest, the
> inuse counter is left inconsistent.
> 
> Call vu_queue_detach_element() before breaking to decrement vq->inuse
> and properly release the element.
> 
> Signed-off-by: Laurent Vivier <lvivier@redhat.com>

Reviewed-by: David Gibson <david@gibson.dropbear.id.au>

> ---
>  vu_common.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/vu_common.c b/vu_common.c
> index 5f2ce18e5b71..ff8f1c046026 100644
> --- a/vu_common.c
> +++ b/vu_common.c
> @@ -190,6 +190,7 @@ static void vu_handle_tx(struct vu_dev *vdev, int index,
>  
>  		if (elem[count].out_num < 1) {
>  			warn("virtio-net transmit queue contains no out buffers");
> +			vu_queue_detach_element(vq);
>  			break;
>  		}
>  
> -- 
> 2.53.0
> 

-- 
David Gibson (he or they)	| I'll have my music baroque, and my code
david AT gibson.dropbear.id.au	| minimalist, thank you, not the other way
				| around.
http://www.ozlabs.org/~dgibson