On Wed, Aug 19, 2020 at 11:14:34AM +0100, John Garry wrote:
> On 19/08/2020 09:58, Ming Lei wrote:
> > > ah, right. I vaguely remember this. Well, if we didn't have a reliable
> > > reproducer before, we do now.
> > OK, that is great, please try the following patch:
> >
> > diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
> > index 32d82e23b095..f18632c524e9 100644
> > --- a/block/blk-mq-tag.c
> > +++ b/block/blk-mq-tag.c
> > @@ -185,19 +185,19 @@ static bool bt_iter(struct sbitmap *bitmap, unsigned int bitnr, void *data)
> > {
> > struct bt_iter_data *iter_data = data;
> > struct blk_mq_hw_ctx *hctx = iter_data->hctx;
> > - struct blk_mq_tags *tags = hctx->tags;
> > + struct blk_mq_tags *tags = hctx->sched_tags ?: hctx->tags;
> > bool reserved = iter_data->reserved;
> > struct request *rq;
> > if (!reserved)
> > bitnr += tags->nr_reserved_tags;
> > - rq = tags->rqs[bitnr];
> > + rq = tags->static_rqs[bitnr];
> > /*
> > * We can hit rq == NULL here, because the tagging functions
> > * test and set the bit before assigning ->rqs[].
> > */
> > - if (rq && rq->q == hctx->queue)
> > + if (rq && rq->tag >= 0 && rq->q == hctx->queue)
> > return iter_data->fn(hctx, rq, iter_data->data, reserved);
> > return true;
> > }
> > @@ -406,7 +406,7 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_iter_fn *fn,
> > return;
> > queue_for_each_hw_ctx(q, hctx, i) {
> > - struct blk_mq_tags *tags = hctx->tags;
> > + struct blk_mq_tags *tags = hctx->sched_tags ?: hctx->tags;
> > /*
> > * If no software queues are currently mapped to this
>
> I gave it a quick try and it looks to silence KASAN. I'll try to test more
> over the next day or so.
>
> BTW, I doubt KASAN is even right to complain about this. I'll check that
> thread you pointed me at to learn more about what was discussed on that.
I guess that elevator switch may have to be involved in your reproducer, stale
request which are freed before switching to new elevator can stay in tags->rqs[],
then these stale requests are retrieved when reading iostat before old request slots in
tags->rqs[] are reset.
The patch should fix this issue.
Thanks,
Ming
