On Tue, Aug 17, 2021 at 08:02:58PM -0700, Bart Van Assche wrote: > On 8/17/21 6:09 PM, Ming Lei wrote: > > +bool is_flush_rq(struct request *rq) > > +{ > > + return rq->end_io == flush_end_io; > > +} > > My understanding is that calling is_flush_rq() is only safe if the > caller guarantees that the request refcount >= 1. How about adding a > comment that explains this? Yeah, we can add the following words, but it isn't something urgent since is_flush_rq() is one block layer internal helper. diff --git a/block/blk-flush.c b/block/blk-flush.c index 4201728bf3a5..babf6262120e 100644 --- a/block/blk-flush.c +++ b/block/blk-flush.c @@ -262,6 +262,11 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error) spin_unlock_irqrestore(&fq->mq_flush_lock, flags); } +/* + * Caller has to grab refcount of this request, otherwise the flush request + * may be re-cycled, then rq->end_io is cleared and kernel panic is caused, + * see blk_mq_put_rq_ref(). + */ bool is_flush_rq(struct request *rq) { return rq->end_io == flush_end_io; Thanks, Ming