Patch "block: pop cached rq before potentially blocking rq_qos_throttle()" has been added to the 5.18-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    block: pop cached rq before potentially blocking rq_qos_throttle()

to the 5.18-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     block-pop-cached-rq-before-potentially-blocking-rq_q.patch
and it can be found in the queue-5.18 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 450750df0a575f36337994d3cbfa35d0343ee85a
Author: Jens Axboe <axboe@xxxxxxxxx>
Date:   Tue Jun 21 10:03:57 2022 -0600

    block: pop cached rq before potentially blocking rq_qos_throttle()
    
    [ Upstream commit 2645672ffe21f0a1c139bfbc05ad30fd4e4f2583 ]
    
    If rq_qos_throttle() ends up blocking, then we will have invalidated and
    flushed our current plug. Since blk_mq_get_cached_request() hasn't
    popped the cached request off the plug list just yet, we end holding a
    pointer to a request that is no longer valid. This insta-crashes with
    rq->mq_hctx being NULL in the validity checks just after.
    
    Pop the request off the cached list before doing rq_qos_throttle() to
    avoid using a potentially stale request.
    
    Fixes: 0a5aa8d161d1 ("block: fix blk_mq_attempt_bio_merge and rq_qos_throttle protection")
    Reported-by: Dylan Yudaken <dylany@xxxxxx>
    Tested-by: Dylan Yudaken <dylany@xxxxxx>
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 631fb87b4976..37caa73bff89 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2777,15 +2777,20 @@ static inline struct request *blk_mq_get_cached_request(struct request_queue *q,
 		return NULL;
 	}
 
-	rq_qos_throttle(q, *bio);
-
 	if (blk_mq_get_hctx_type((*bio)->bi_opf) != rq->mq_hctx->type)
 		return NULL;
 	if (op_is_flush(rq->cmd_flags) != op_is_flush((*bio)->bi_opf))
 		return NULL;
 
-	rq->cmd_flags = (*bio)->bi_opf;
+	/*
+	 * If any qos ->throttle() end up blocking, we will have flushed the
+	 * plug and hence killed the cached_rq list as well. Pop this entry
+	 * before we throttle.
+	 */
 	plug->cached_rq = rq_list_next(rq);
+	rq_qos_throttle(q, *bio);
+
+	rq->cmd_flags = (*bio)->bi_opf;
 	INIT_LIST_HEAD(&rq->queuelist);
 	return rq;
 }