On Tue, May 22, 2018 at 09:25:15AM -0700, Bart Van Assche wrote: > @@ -848,13 +843,22 @@ static void blk_mq_rq_timed_out(struct request *req, bool reserved) > case BLK_EH_RESET_TIMER: > + blk_mq_add_timer(req); > /* > + * The loop is for the unlikely case of a race with the > + * completion code. There is no need to reset the deadline > + * if the transition to the in-flight state fails because > + * the deadline only matters in the in-flight state. > */ > - blk_mq_rq_update_aborted_gstate(req, 0); > - blk_add_timer(req); > + while (true) { > + if (blk_mq_change_rq_state(req, MQ_RQ_TIMED_OUT, > + MQ_RQ_IN_FLIGHT)) > + break; > + if (blk_mq_rq_state(req) == MQ_RQ_COMPLETE) { > + __blk_mq_complete_request(req); > + break; > + } > + } I'm having some trouble triggering this case where the state is already MQ_RQ_COMPLETE, so I'm just trying to figure this out through inspection. It looks like the new blk_mq_complete_request() already called __blk_mq_complete_request() when it gets the state to MQ_RQ_COMPLETE, so doing that again completes it a second time.