On 9/23/21 11:55 AM, Jens Axboe wrote: > On 9/23/21 11:51 AM, Bart Van Assche wrote: >> On 9/23/21 9:39 AM, Jens Axboe wrote: >>> On 9/23/21 10:22 AM, Bart Van Assche wrote: >>>> On 9/23/21 9:04 AM, Jens Axboe wrote: >>>>> What options are you loading null_blk with? >>>> >>>> The issues I reported are the result of running test blk/010 from the >>>> blktests suite. That test loads the null_blk kernel module twice: >>>> >>>> _init_null_blk queue_mode=2 submit_queues=16 nr_devices=32 >>>> [ ... ] >>>> _exit_null_blk >>>> _init_null_blk queue_mode=2 submit_queues=16 nr_devices=32 shared_tags=1 >>>> [ ... ] >>>> _exit_null_blk >>>> >>>> Please let me know if you need more information. >>> >>> Tried both that and running block/010, didn't trigger anything for me. >>> Odd... >> >> Hi Jens, >> >> I took another look at the kernel logs from yesterday of the VM that I use >> for testing. In that kernel log I found the following: >> * Without any changes on top of the for-next branch of >> git://git.kernel.dk/linux-block (commit 4129031563d0 ("Merge branch >> 'for-5.16/io_uring' into for-next"), test block/010 triggers the oops >> reported at the start of this email thread. >> * With the patch at the start of this email thread applied, the first test >> that triggers a kernel oops is block/020 (blk_mq_free_rqs+0x1f4). >> >> This morning I rebuilt the block for-next kernel with and without my >> null_blk patch applied. I was able to reproduce what I observed yesterday. >> Test block/020 passes with if commit 5f7acddf706c ("null_blk: poll queue >> support") is reverted. This is why I wrote that my patch does not seem to >> be sufficient to fix commit 5f7acddf706c. > > Ah ok, so it's block/020, not block/010 for the later one. I'll take a > look. I think it's the assumption that poll_queueus == submit_queues. Does this work for you? diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c index eb5cfe189e90..dac88c5daff9 100644 --- a/drivers/block/null_blk/main.c +++ b/drivers/block/null_blk/main.c @@ -1748,7 +1757,7 @@ static int setup_queues(struct nullb *nullb) int nqueues = nr_cpu_ids; if (g_poll_queues) - nqueues *= 2; + nqueues += g_poll_queues; nullb->queues = kcalloc(nqueues, sizeof(struct nullb_queue), GFP_KERNEL); @@ -1814,7 +1823,7 @@ static int null_init_tag_set(struct nullb *nullb, struct blk_mq_tag_set *set) g_submit_queues; poll_queues = nullb ? nullb->dev->poll_queues : g_poll_queues; if (poll_queues) - set->nr_hw_queues *= 2; + set->nr_hw_queues += poll_queues; set->queue_depth = nullb ? nullb->dev->hw_queue_depth : g_hw_queue_depth; set->numa_node = nullb ? nullb->dev->home_node : g_home_node; -- Jens Axboe