92 lines
2.7 KiB
Diff
92 lines
2.7 KiB
Diff
|
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Ming Lei <ming.lei@redhat.com>
|
||
|
|
Date: Fri, 10 Sep 2021 14:30:16 +0200
|
||
|
|
Subject: [PATCH] blk-mq: fix is_flush_rq
|
||
|
|
|
||
|
|
commit a9ed27a764156929efe714033edb3e9023c5f321 upstream.
|
||
|
|
|
||
|
|
is_flush_rq() is called from bt_iter()/bt_tags_iter(), and runs the
|
||
|
|
following check:
|
||
|
|
|
||
|
|
hctx->fq->flush_rq == req
|
||
|
|
|
||
|
|
but the passed hctx from bt_iter()/bt_tags_iter() may be NULL because:
|
||
|
|
|
||
|
|
1) memory re-order in blk_mq_rq_ctx_init():
|
||
|
|
|
||
|
|
rq->mq_hctx = data->hctx;
|
||
|
|
...
|
||
|
|
refcount_set(&rq->ref, 1);
|
||
|
|
|
||
|
|
OR
|
||
|
|
|
||
|
|
2) tag re-use and ->rqs[] isn't updated with new request.
|
||
|
|
|
||
|
|
Fix the issue by re-writing is_flush_rq() as:
|
||
|
|
|
||
|
|
return rq->end_io == flush_end_io;
|
||
|
|
|
||
|
|
which turns out simpler to follow and immune to data race since we have
|
||
|
|
ordered WRITE rq->end_io and refcount_set(&rq->ref, 1).
|
||
|
|
|
||
|
|
Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter")
|
||
|
|
Cc: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
|
||
|
|
Cc: Yufen Yu <yuyufen@huawei.com>
|
||
|
|
Signed-off-by: Ming Lei <ming.lei@redhat.com>
|
||
|
|
Link: https://lore.kernel.org/r/20210818010925.607383-1-ming.lei@redhat.com
|
||
|
|
Signed-off-by: Jens Axboe <axboe@kernel.dk>
|
||
|
|
Cc: Yi Zhang <yi.zhang@redhat.com>
|
||
|
|
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
|
||
|
|
---
|
||
|
|
block/blk-flush.c | 5 +++++
|
||
|
|
block/blk-mq.c | 2 +-
|
||
|
|
block/blk.h | 6 +-----
|
||
|
|
3 files changed, 7 insertions(+), 6 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/block/blk-flush.c b/block/blk-flush.c
|
||
|
|
index 8b11ab3b3762..705ee6c99020 100644
|
||
|
|
--- a/block/blk-flush.c
|
||
|
|
+++ b/block/blk-flush.c
|
||
|
|
@@ -262,6 +262,11 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error)
|
||
|
|
spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
|
||
|
|
}
|
||
|
|
|
||
|
|
+bool is_flush_rq(struct request *rq)
|
||
|
|
+{
|
||
|
|
+ return rq->end_io == flush_end_io;
|
||
|
|
+}
|
||
|
|
+
|
||
|
|
/**
|
||
|
|
* blk_kick_flush - consider issuing flush request
|
||
|
|
* @q: request_queue being kicked
|
||
|
|
diff --git a/block/blk-mq.c b/block/blk-mq.c
|
||
|
|
index cb619ec8aaf2..601e40204d06 100644
|
||
|
|
--- a/block/blk-mq.c
|
||
|
|
+++ b/block/blk-mq.c
|
||
|
|
@@ -937,7 +937,7 @@ static bool blk_mq_req_expired(struct request *rq, unsigned long *next)
|
||
|
|
|
||
|
|
void blk_mq_put_rq_ref(struct request *rq)
|
||
|
|
{
|
||
|
|
- if (is_flush_rq(rq, rq->mq_hctx))
|
||
|
|
+ if (is_flush_rq(rq))
|
||
|
|
rq->end_io(rq, 0);
|
||
|
|
else if (refcount_dec_and_test(&rq->ref))
|
||
|
|
__blk_mq_free_request(rq);
|
||
|
|
diff --git a/block/blk.h b/block/blk.h
|
||
|
|
index 7550364c326c..4a4ffd992790 100644
|
||
|
|
--- a/block/blk.h
|
||
|
|
+++ b/block/blk.h
|
||
|
|
@@ -43,11 +43,7 @@ static inline void __blk_get_queue(struct request_queue *q)
|
||
|
|
kobject_get(&q->kobj);
|
||
|
|
}
|
||
|
|
|
||
|
|
-static inline bool
|
||
|
|
-is_flush_rq(struct request *req, struct blk_mq_hw_ctx *hctx)
|
||
|
|
-{
|
||
|
|
- return hctx->fq->flush_rq == req;
|
||
|
|
-}
|
||
|
|
+bool is_flush_rq(struct request *req);
|
||
|
|
|
||
|
|
struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
|
||
|
|
gfp_t flags);
|