On 8/17/21 7:09 PM, Ming Lei wrote:
> is_flush_rq() is called from bt_iter()/bt_tags_iter(), and runs the
> following check:
>
> hctx->fq->flush_rq == req
>
> but the passed hctx from bt_iter()/bt_tags_iter() may be NULL because:
>
> 1) memory re-order in blk_mq_rq_ctx_init():
>
> rq->mq_hctx = data->hctx;
> ...
> refcount_set(&rq->ref, 1);
>
> OR
>
> 2) tag re-use and ->rqs[] isn't updated with new request.
>
> Fix the issue by re-writing is_flush_rq() as:
>
> return rq->end_io == flush_end_io;
>
> which turns out simpler to follow and immune to data race since we have
> ordered WRITE rq->end_io and refcount_set(&rq->ref, 1).
That is way better, applied thanks.
> Fixes: 2e315dc07df0 ("blk-mq: grab rq->refcount before calling ->fn in
> blk_mq_tagset_busy_iter")
I think your mailer was a bit too eager to split lines here. I fixed it up.
--
Jens Axboe
