This is a note to let you know that I've just added the patch titled
block, bfq: fix queue removal from weights tree
to the 4.19-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
block-bfq-fix-queue-removal-from-weights-tree.patch
and it can be found in the queue-4.19 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From foo@baz Wed Dec 22 01:08:34 PM CET 2021
From: Yu Kuai <yukuai3@xxxxxxxxxx>
Date: Tue, 21 Dec 2021 19:38:48 +0800
Subject: block, bfq: fix queue removal from weights tree
To: <jack@xxxxxxx>, <gregkh@xxxxxxxxxxxxxxxxxxx>, <paolo.valente@xxxxxxxxxx>, <axboe@xxxxxxxxx>
Cc: <linux-block@xxxxxxxxxxxxxxx>, <linux-kernel@xxxxxxxxxxxxxxx>, <yukuai3@xxxxxxxxxx>, <yi.zhang@xxxxxxxxxx>
Message-ID: <20211221113849.2219126-5-yukuai3@xxxxxxxxxx>
From: Paolo Valente <paolo.valente@xxxxxxxxxx>
commit 9dee8b3b057e1da26f85f1842f2aaf3bb200fb94 upstream.
bfq maintains an ordered list, through a red-black tree, of unique
weights of active bfq_queues. This list is used to detect whether there
are active queues with differentiated weights. The weight of a queue is
removed from the list when both the following two conditions become
true:
(1) the bfq_queue is flagged as inactive
(2) the has no in-flight request any longer;
Unfortunately, in the rare cases where condition (2) becomes true before
condition (1), the removal fails, because the function to remove the
weight of the queue (bfq_weights_tree_remove) is rightly invoked in the
path that deactivates the bfq_queue, but mistakenly invoked *before* the
function that actually performs the deactivation (bfq_deactivate_bfqq).
This commits moves the invocation of bfq_weights_tree_remove for
condition (1) to after bfq_deactivate_bfqq. As a consequence of this
move, it is necessary to add a further reference to the queue when the
weight of a queue is added, because the queue might otherwise be freed
before bfq_weights_tree_remove is invoked. This commit adds this
reference and makes all related modifications.
Signed-off-by: Paolo Valente <paolo.valente@xxxxxxxxxx>
Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
Signed-off-by: Yu Kuai <yukuai3@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
block/bfq-iosched.c | 17 +++++++++++++----
block/bfq-wf2q.c | 6 +++---
2 files changed, 16 insertions(+), 7 deletions(-)
--- a/block/bfq-iosched.c
+++ b/block/bfq-iosched.c
@@ -748,6 +748,7 @@ void bfq_weights_tree_add(struct bfq_dat
inc_counter:
bfqq->weight_counter->num_active++;
+ bfqq->ref++;
}
/*
@@ -772,6 +773,7 @@ void __bfq_weights_tree_remove(struct bf
reset_entity_pointer:
bfqq->weight_counter = NULL;
+ bfq_put_queue(bfqq);
}
/*
@@ -783,9 +785,6 @@ void bfq_weights_tree_remove(struct bfq_
{
struct bfq_entity *entity = bfqq->entity.parent;
- __bfq_weights_tree_remove(bfqd, bfqq,
- &bfqd->queue_weights_tree);
-
for_each_entity(entity) {
struct bfq_sched_data *sd = entity->my_sched_data;
@@ -819,6 +818,15 @@ void bfq_weights_tree_remove(struct bfq_
bfqd->num_groups_with_pending_reqs--;
}
}
+
+ /*
+ * Next function is invoked last, because it causes bfqq to be
+ * freed if the following holds: bfqq is not in service and
+ * has no dispatched request. DO NOT use bfqq after the next
+ * function invocation.
+ */
+ __bfq_weights_tree_remove(bfqd, bfqq,
+ &bfqd->queue_weights_tree);
}
/*
@@ -1012,7 +1020,8 @@ bfq_bfqq_resume_state(struct bfq_queue *
static int bfqq_process_refs(struct bfq_queue *bfqq)
{
- return bfqq->ref - bfqq->allocated - bfqq->entity.on_st;
+ return bfqq->ref - bfqq->allocated - bfqq->entity.on_st -
+ (bfqq->weight_counter != NULL);
}
/* Empty burst list and add just bfqq (see comments on bfq_handle_burst) */
--- a/block/bfq-wf2q.c
+++ b/block/bfq-wf2q.c
@@ -1668,15 +1668,15 @@ void bfq_del_bfqq_busy(struct bfq_data *
bfqd->busy_queues--;
- if (!bfqq->dispatched)
- bfq_weights_tree_remove(bfqd, bfqq);
-
if (bfqq->wr_coeff > 1)
bfqd->wr_busy_queues--;
bfqg_stats_update_dequeue(bfqq_group(bfqq));
bfq_deactivate_bfqq(bfqd, bfqq, true, expiration);
+
+ if (!bfqq->dispatched)
+ bfq_weights_tree_remove(bfqd, bfqq);
}
/*
Patches currently in stable-queue which might be from yukuai3@xxxxxxxxxx are
queue-4.19/block-bfq-improve-asymmetric-scenarios-detection.patch
queue-4.19/block-bfq-fix-use-after-free-in-bfq_bfqq_expire.patch
queue-4.19/block-bfq-fix-decrement-of-num_active_groups.patch
queue-4.19/block-bfq-fix-queue-removal-from-weights-tree.patch
queue-4.19/block-bfq-fix-asymmetric-scenarios-detection.patch
