Hi Ming
Why not add percpu_ref_tryget/put pair into run queue and requeue work,
or before queue the work ?
Then freezing queue could really implement to freeze the queue and there will be
no any queue activity after freeze, including run queue and requeue work.
Thanks
Jianchao
On 4/4/19 4:43 PM, Ming Lei wrote:
> Inside __blk_mq_update_nr_hw_queues(), only request queues are frozen
> before updating nr_hw_queues.
>
> However, even though blk_mq_freeze_queue() is returned, there might be
> run queue activity not completed, then use-after-free may be triggered
> on hctx and its fields.
>
> Fix this issue by really quiescing queue via blk_mq_quiesce_queue() and
> blk_sync_queue() for making sure no any run queue activity pending
> before releasing hctx.
>
> Cc: Dongli Zhang <dongli.zhang@xxxxxxxxxx>
> Cc: James Smart <james.smart@xxxxxxxxxxxx>
> Cc: Bart Van Assche <bart.vanassche@xxxxxxx>
> Cc: linux-scsi@xxxxxxxxxxxxxxx,
> Cc: Martin K . Petersen <martin.petersen@xxxxxxxxxx>,
> Cc: Christoph Hellwig <hch@xxxxxx>,
> Cc: James E . J . Bottomley <jejb@xxxxxxxxxxxxxxxxxx>,
> Cc: jianchao wang <jianchao.w.wang@xxxxxxxxxx>
> Reported-by: Bart Van Assche <bvanassche@xxxxxxx>
> Signed-off-by: Ming Lei <ming.lei@xxxxxxxxxx>
> ---
> block/blk-mq.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index b512ba0cb359..41c12d9008b7 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -3224,8 +3224,11 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,
> if (nr_hw_queues < 1 || nr_hw_queues == set->nr_hw_queues)
> return;
>
> - list_for_each_entry(q, &set->tag_list, tag_set_list)
> + list_for_each_entry(q, &set->tag_list, tag_set_list) {
> blk_mq_freeze_queue(q);
> + blk_mq_quiesce_queue(q);
> + blk_sync_queue(q);
> + }
> /*
> * Sync with blk_mq_queue_tag_busy_iter.
> */
> @@ -3269,8 +3272,10 @@ static void __blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set,
> list_for_each_entry(q, &set->tag_list, tag_set_list)
> blk_mq_elv_switch_back(&head, q);
>
> - list_for_each_entry(q, &set->tag_list, tag_set_list)
> + list_for_each_entry(q, &set->tag_list, tag_set_list) {
> + blk_mq_unquiesce_queue(q);
> blk_mq_unfreeze_queue(q);
> + }
> }
>
> void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
>
