This is a note to let you know that I've just added the patch titled block, bfq: fix queue removal from weights tree to the 4.19-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: block-bfq-fix-queue-removal-from-weights-tree.patch and it can be found in the queue-4.19 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Wed Dec 22 01:08:34 PM CET 2021 From: Yu Kuai <yukuai3@xxxxxxxxxx> Date: Tue, 21 Dec 2021 19:38:48 +0800 Subject: block, bfq: fix queue removal from weights tree To: <jack@xxxxxxx>, <gregkh@xxxxxxxxxxxxxxxxxxx>, <paolo.valente@xxxxxxxxxx>, <axboe@xxxxxxxxx> Cc: <linux-block@xxxxxxxxxxxxxxx>, <linux-kernel@xxxxxxxxxxxxxxx>, <yukuai3@xxxxxxxxxx>, <yi.zhang@xxxxxxxxxx> Message-ID: <20211221113849.2219126-5-yukuai3@xxxxxxxxxx> From: Paolo Valente <paolo.valente@xxxxxxxxxx> commit 9dee8b3b057e1da26f85f1842f2aaf3bb200fb94 upstream. bfq maintains an ordered list, through a red-black tree, of unique weights of active bfq_queues. This list is used to detect whether there are active queues with differentiated weights. The weight of a queue is removed from the list when both the following two conditions become true: (1) the bfq_queue is flagged as inactive (2) the has no in-flight request any longer; Unfortunately, in the rare cases where condition (2) becomes true before condition (1), the removal fails, because the function to remove the weight of the queue (bfq_weights_tree_remove) is rightly invoked in the path that deactivates the bfq_queue, but mistakenly invoked *before* the function that actually performs the deactivation (bfq_deactivate_bfqq). This commits moves the invocation of bfq_weights_tree_remove for condition (1) to after bfq_deactivate_bfqq. As a consequence of this move, it is necessary to add a further reference to the queue when the weight of a queue is added, because the queue might otherwise be freed before bfq_weights_tree_remove is invoked. This commit adds this reference and makes all related modifications. Signed-off-by: Paolo Valente <paolo.valente@xxxxxxxxxx> Signed-off-by: Jens Axboe <axboe@xxxxxxxxx> Signed-off-by: Yu Kuai <yukuai3@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- block/bfq-iosched.c | 17 +++++++++++++---- block/bfq-wf2q.c | 6 +++--- 2 files changed, 16 insertions(+), 7 deletions(-) --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -748,6 +748,7 @@ void bfq_weights_tree_add(struct bfq_dat inc_counter: bfqq->weight_counter->num_active++; + bfqq->ref++; } /* @@ -772,6 +773,7 @@ void __bfq_weights_tree_remove(struct bf reset_entity_pointer: bfqq->weight_counter = NULL; + bfq_put_queue(bfqq); } /* @@ -783,9 +785,6 @@ void bfq_weights_tree_remove(struct bfq_ { struct bfq_entity *entity = bfqq->entity.parent; - __bfq_weights_tree_remove(bfqd, bfqq, - &bfqd->queue_weights_tree); - for_each_entity(entity) { struct bfq_sched_data *sd = entity->my_sched_data; @@ -819,6 +818,15 @@ void bfq_weights_tree_remove(struct bfq_ bfqd->num_groups_with_pending_reqs--; } } + + /* + * Next function is invoked last, because it causes bfqq to be + * freed if the following holds: bfqq is not in service and + * has no dispatched request. DO NOT use bfqq after the next + * function invocation. + */ + __bfq_weights_tree_remove(bfqd, bfqq, + &bfqd->queue_weights_tree); } /* @@ -1012,7 +1020,8 @@ bfq_bfqq_resume_state(struct bfq_queue * static int bfqq_process_refs(struct bfq_queue *bfqq) { - return bfqq->ref - bfqq->allocated - bfqq->entity.on_st; + return bfqq->ref - bfqq->allocated - bfqq->entity.on_st - + (bfqq->weight_counter != NULL); } /* Empty burst list and add just bfqq (see comments on bfq_handle_burst) */ --- a/block/bfq-wf2q.c +++ b/block/bfq-wf2q.c @@ -1668,15 +1668,15 @@ void bfq_del_bfqq_busy(struct bfq_data * bfqd->busy_queues--; - if (!bfqq->dispatched) - bfq_weights_tree_remove(bfqd, bfqq); - if (bfqq->wr_coeff > 1) bfqd->wr_busy_queues--; bfqg_stats_update_dequeue(bfqq_group(bfqq)); bfq_deactivate_bfqq(bfqd, bfqq, true, expiration); + + if (!bfqq->dispatched) + bfq_weights_tree_remove(bfqd, bfqq); } /* Patches currently in stable-queue which might be from yukuai3@xxxxxxxxxx are queue-4.19/block-bfq-improve-asymmetric-scenarios-detection.patch queue-4.19/block-bfq-fix-use-after-free-in-bfq_bfqq_expire.patch queue-4.19/block-bfq-fix-decrement-of-num_active_groups.patch queue-4.19/block-bfq-fix-queue-removal-from-weights-tree.patch queue-4.19/block-bfq-fix-asymmetric-scenarios-detection.patch