xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

blk-mq: fix is_flush_rq

Browse Source 
commit a9ed27a764156929efe714033edb3e9023c5f321 upstream.

is_flush_rq() is called from bt_iter()/bt_tags_iter(), and runs the
following check:

	hctx->fq->flush_rq == req

but the passed hctx from bt_iter()/bt_tags_iter() may be NULL because:

1) memory re-order in blk_mq_rq_ctx_init():

	rq->mq_hctx = data->hctx;
	...
	refcount_set(&rq->ref, 1);

OR

2) tag re-use and ->rqs[] isn't updated with new request.

Fix the issue by re-writing is_flush_rq() as:

	return rq->end_io == flush_end_io;

which turns out simpler to follow and immune to data race since we have
ordered WRITE rq->end_io and refcount_set(&rq->ref, 1).

Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter")
Cc: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
Cc: Yufen Yu <yuyufen@huawei.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20210818010925.607383-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Cc: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ming Lei
2021-08-18 09:09:25 +08:00
committed by Greg Kroah-Hartman
parent ceffaa61b5
commit cad6239f50
3 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
block/blk-flush.c
View File

@@ -263,6 +263,11 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error)
spin_unlock_irqrestore(&fq->mq_flush_lock, flags); spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
} }
bool is_flush_rq(struct request *rq)
{
return rq->end_io == flush_end_io;
}
/** /**
* blk_kick_flush - consider issuing flush request * blk_kick_flush - consider issuing flush request
* @q: request_queue being kicked * @q: request_queue being kicked

2
block/blk-mq.c
View File

@@ -929,7 +929,7 @@ static bool blk_mq_req_expired(struct request *rq, unsigned long *next)
void blk_mq_put_rq_ref(struct request *rq) void blk_mq_put_rq_ref(struct request *rq)
{ {
if (is_flush_rq(rq, rq->mq_hctx)) if (is_flush_rq(rq))
rq->end_io(rq, 0); rq->end_io(rq, 0);
else if (refcount_dec_and_test(&rq->ref)) else if (refcount_dec_and_test(&rq->ref))
__blk_mq_free_request(rq); __blk_mq_free_request(rq);

6
block/blk.h
View File

@@ -44,11 +44,7 @@ static inline void __blk_get_queue(struct request_queue *q)
kobject_get(&q->kobj); kobject_get(&q->kobj);
} }
static inline bool bool is_flush_rq(struct request *req);
is_flush_rq(struct request *req, struct blk_mq_hw_ctx *hctx)
{
return hctx->fq->flush_rq == req;
}
struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size, struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
gfp_t flags); gfp_t flags);