BACKPORT: blk-mq: fix is_flush_rq
is_flush_rq() is called from bt_iter()/bt_tags_iter(), and runs the
following check:
hctx->fq->flush_rq == req
but the passed hctx from bt_iter()/bt_tags_iter() may be NULL because:
1) memory re-order in blk_mq_rq_ctx_init():
rq->mq_hctx = data->hctx;
...
refcount_set(&rq->ref, 1);
OR
2) tag re-use and ->rqs[] isn't updated with new request.
Fix the issue by re-writing is_flush_rq() as:
return rq->end_io == flush_end_io;
which turns out simpler to follow and immune to data race since we have
ordered WRITE rq->end_io and refcount_set(&rq->ref, 1).
Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in
blk_mq_tagset_busy_iter")
Cc: "Blank-Burian, Markus, Dr." <blankburian@uni-muenster.de>
Cc: Yufen Yu <yuyufen@huawei.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>.
Bug: 197804811
Change-Id: I4c19fc2c7d39235b0e95a622f26646a353a19ee9
[Upstream: cherry picked from commit a9ed27a764156929efe714033edb3e9023c5f321]
[Pradeep: Resolved conflicts in block/blk.h]
Signed-off-by: Pradeep P V K <pragalla@codeaurora.org>
Git-commit: ec1b6ab9fe80cf689780c9ee3b2cdb04cc11895e
Git-repo: https://android.googlesource.com/kernel/common/
Signed-off-by: Pradeep P V K <quic_pragalla@quicinc.com>
(cherry picked from commit 49724e13eb
)
Change-Id: I866184c8fb0d5708fc582c1aff0c4084a911a291
Signed-off-by: Surapusetty Naresh Babu <snareshb@qti.qualcomm.com>
This commit is contained in:
parent
70249194f9
commit
09de4ca5ab
3 changed files with 7 additions and 9 deletions
|
@ -289,6 +289,11 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error)
|
|||
spin_unlock_irqrestore(&fq->mq_flush_lock, flags);
|
||||
}
|
||||
|
||||
bool is_flush_rq(struct request *rq)
|
||||
{
|
||||
return rq->end_io == flush_end_io;
|
||||
}
|
||||
|
||||
/**
|
||||
* blk_kick_flush - consider issuing flush request
|
||||
* @q: request_queue being kicked
|
||||
|
|
|
@ -814,10 +814,7 @@ static bool blk_mq_req_expired(struct request *rq, unsigned long *next)
|
|||
|
||||
void blk_mq_put_rq_ref(struct request *rq)
|
||||
{
|
||||
struct blk_mq_hw_ctx *hctx;
|
||||
|
||||
hctx = blk_mq_map_queue(rq->q, rq->mq_ctx->cpu);
|
||||
if (is_flush_rq(rq, hctx))
|
||||
if (is_flush_rq(rq))
|
||||
rq->end_io(rq, 0);
|
||||
else if (refcount_dec_and_test(&rq->ref))
|
||||
__blk_mq_free_request(rq);
|
||||
|
|
|
@ -124,11 +124,7 @@ static inline void __blk_get_queue(struct request_queue *q)
|
|||
kobject_get(&q->kobj);
|
||||
}
|
||||
|
||||
static inline bool
|
||||
is_flush_rq(struct request *req, struct blk_mq_hw_ctx *hctx)
|
||||
{
|
||||
return hctx->fq->flush_rq == req;
|
||||
}
|
||||
bool is_flush_rq(struct request *req);
|
||||
|
||||
struct blk_flush_queue *blk_alloc_flush_queue(struct request_queue *q,
|
||||
int node, int cmd_size, gfp_t flags);
|
||||
|
|
Loading…
Reference in a new issue