Hi Keith On 3/27/19 10:33 AM, Keith Busch wrote: > On Wed, Mar 27, 2019 at 10:27:57AM +0800, jianchao.wang wrote: >> As the comment above, the stable request maybe something that has been freed due to following case, >> 1. a hctx->fq.flush_rq of dead request_queue that shares the same tagset >> 2. a removed io scheduler's sched request >> and this freed request could be allocated by others which may change the field of request->state. > > You're not explaing how that request->state is changed. I understand the > request can be reallocated, but what is changing its state? > Sorry for my bad description, and lead to the misunderstand. The _free_ below means, 1. a hctx->fq.flush_rq of dead request_queue that shares the same tagset The whole request_queue is cleaned up and freed, so the hctx->fq.flush is freed back to a slab 2. a removed io scheduler's sched request The io scheduled is detached and all of the structures are freed, including the pages where sched requests locates. So the pointers in tags->rqs[] may point to memory that is not used as a blk layer request. Thanks Jianchao
