patches/kernel/0011-blk-mq-fix-is_flush_rq.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Ming Lei <ming.lei@redhat.com>
   3 Date: Fri, 10 Sep 2021 14:30:16 +0200
   4 Subject: [PATCH] blk-mq: fix is_flush_rq
   5
   6 commit a9ed27a764156929efe714033edb3e9023c5f321 upstream.
   7
   8 is_flush_rq() is called from bt_iter()/bt_tags_iter(), and runs the
   9 following check:
  10
  11         hctx->fq->flush_rq == req
  12
  13 but the passed hctx from bt_iter()/bt_tags_iter() may be NULL because:
  14
  15 1) memory re-order in blk_mq_rq_ctx_init():
  16
  17         rq->mq_hctx = data->hctx;
  18         ...
  19         refcount_set(&rq->ref, 1);
  20
  21 OR
  22
  23 2) tag re-use and ->rqs[] isn't updated with new request.
  24
  25 Fix the issue by re-writing is_flush_rq() as:
  26
  27         return rq->end_io == flush_end_io;
  28
  29 which turns out simpler to follow and immune to data race since we have
  30 ordered WRITE rq->end_io and refcount_set(&rq->ref, 1).
  31
  32 Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in blk_mq_tagset_busy_iter")
  33 Cc: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
  34 Cc: Yufen Yu <yuyufen@huawei.com>
  35 Signed-off-by: Ming Lei <ming.lei@redhat.com>
  36 Link: https://lore.kernel.org/r/20210818010925.607383-1-ming.lei@redhat.com
  37 Signed-off-by: Jens Axboe <axboe@kernel.dk>
  38 Cc: Yi Zhang <yi.zhang@redhat.com>
  39 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  40 ---
  41  block/blk-flush.c | 5 +++++
  42  block/blk-mq.c    | 2 +-
  43  block/blk.h       | 6 +-----
  44  3 files changed, 7 insertions(+), 6 deletions(-)
  45
  46 diff --git a/block/blk-flush.c b/block/blk-flush.c
  47 index 8b11ab3b3762..705ee6c99020 100644
  48 --- a/block/blk-flush.c
  49 +++ b/block/blk-flush.c
  50 @@ -262,6 +262,11 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error)
  51         spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
  52  }
  53
  54 +bool is_flush_rq(struct request *rq)
  55 +{
  56 +       return rq->end_io == flush_end_io;
  57 +}
  58 +
  59  /**
  60   * blk_kick_flush - consider issuing flush request
  61   * @q: request_queue being kicked
  62 diff --git a/block/blk-mq.c b/block/blk-mq.c
  63 index cb619ec8aaf2..601e40204d06 100644
  64 --- a/block/blk-mq.c
  65 +++ b/block/blk-mq.c
  66 @@ -937,7 +937,7 @@ static bool blk_mq_req_expired(struct request *rq, unsigned long *next)
  67
  68  void blk_mq_put_rq_ref(struct request *rq)
  69  {
  70 -       if (is_flush_rq(rq, rq->mq_hctx))
  71 +       if (is_flush_rq(rq))
  72                 rq->end_io(rq, 0);
  73         else if (refcount_dec_and_test(&rq->ref))
  74                 __blk_mq_free_request(rq);
  75 diff --git a/block/blk.h b/block/blk.h
  76 index 7550364c326c..4a4ffd992790 100644
  77 --- a/block/blk.h
  78 +++ b/block/blk.h
  79 @@ -43,11 +43,7 @@ static inline void __blk_get_queue(struct request_queue *q)
  80         kobject_get(&q->kobj);
  81  }
  82
  83 -static inline bool
  84 -is_flush_rq(struct request *req, struct blk_mq_hw_ctx *hctx)
  85 -{
  86 -       return hctx->fq->flush_rq == req;
  87 -}
  88 +bool is_flush_rq(struct request *req);
  89
  90  struct blk_flush_queue *blk_alloc_flush_queue(int node, int cmd_size,
  91                                               gfp_t flags);