On Mon, Jun 08, 2020 at 08:45:57AM -0700, Christoph Hellwig wrote: > On Mon, Jun 08, 2020 at 01:58:00PM +0200, Peter Zijlstra wrote: > > Hi Jens, > > > > I've been going through smp_call_function_single_async() users and > > stumbled upon blk-softirq.c, which has: > > > > static int raise_blk_irq(int cpu, struct request *rq) > > { > > if (cpu_online(cpu)) { > > call_single_data_t *data = &rq->csd; > > > > data->func = trigger_softirq; > > data->info = rq; > > data->flags = 0; > > > > smp_call_function_single_async(cpu, data); > > return 0; > > } > > > > return 1; > > } > > > > What, if anything, guarantees rq->csd is not already in use at that > > time? > > A request can only be completed once. Sure, but that doesn't help. CPU0 CPU1 raise_blk_irq() BLOCK_SOFTIRQ IPI -> CPU1 // picks up thing from CPU0 req->complete(req); <big hole where CSD is active and request completed> <IPI> trigger_softirq() What happens to a struct request after completion, is it free()d or reused? If reused, how do we guarantee CSD completion before free()ing?