On 3/30/19 8:09 PM, Ming Lei wrote:
Since 45a9c9d909b2 ("blk-mq: Fix a use-after-free"), run queue isn't
allowed during cleanup queue even though queue refcount is held.
This change has caused lots of kernel oops triggered in run queue path,
turns out it isn't easy to fix them all.
So move freeing of hw queue resources into queue's release handler, then
the above issue is fixed. Meantime, this way is safe given freeing hw
queue resource doesn't require to use tags.
I'm not sure the approach of this patch series is really the direction
we should pursue. There are many block driver that free resources
immediately after blk_cleanup_queue() returns. An example from the brd
driver:
static void brd_free(struct brd_device *brd)
{
put_disk(brd->brd_disk);
blk_cleanup_queue(brd->brd_queue);
brd_free_pages(brd);
kfree(brd);
}
I'd like to avoid having to modify all block drivers that free resources
immediately after blk_cleanup_queue() has returned. Have you considered
to modify blk_mq_run_hw_queues() such that it becomes safe to call that
function while blk_cleanup_queue() is in progress, e.g. by inserting a
percpu_ref_tryget_live(&q->q_usage_counter) /
percpu_ref_put(&q->q_usage_counter) pair?
Thanks,
Bart.
