Patch "blk-mq: fix race condition in active queue accounting" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    blk-mq: fix race condition in active queue accounting

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     blk-mq-fix-race-condition-in-active-queue-accounting.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 7d3619700ce03dbf88f176046df552aec7a6646a
Author: Tian Lan <tian.lan@xxxxxxxxxxxx>
Date:   Mon May 22 17:05:55 2023 -0400

    blk-mq: fix race condition in active queue accounting
    
    [ Upstream commit 3e94d54e83cafd2b562bb6d15bb2f72d76200fb5 ]
    
    If multiple CPUs are sharing the same hardware queue, it can
    cause leak in the active queue counter tracking when __blk_mq_tag_busy()
    is executed simultaneously.
    
    Fixes: ee78ec1077d3 ("blk-mq: blk_mq_tag_busy is no need to return a value")
    Signed-off-by: Tian Lan <tian.lan@xxxxxxxxxxxx>
    Reviewed-by: Ming Lei <ming.lei@xxxxxxxxxx>
    Reviewed-by: Damien Le Moal <dlemoal@xxxxxxxxxx>
    Reviewed-by: John Garry <john.g.garry@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230522210555.794134-1-tilan7663@xxxxxxxxx
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 9eb968e14d31f..a80d7c62bdfe6 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -41,16 +41,20 @@ void __blk_mq_tag_busy(struct blk_mq_hw_ctx *hctx)
 {
 	unsigned int users;
 
+	/*
+	 * calling test_bit() prior to test_and_set_bit() is intentional,
+	 * it avoids dirtying the cacheline if the queue is already active.
+	 */
 	if (blk_mq_is_shared_tags(hctx->flags)) {
 		struct request_queue *q = hctx->queue;
 
-		if (test_bit(QUEUE_FLAG_HCTX_ACTIVE, &q->queue_flags))
+		if (test_bit(QUEUE_FLAG_HCTX_ACTIVE, &q->queue_flags) ||
+		    test_and_set_bit(QUEUE_FLAG_HCTX_ACTIVE, &q->queue_flags))
 			return;
-		set_bit(QUEUE_FLAG_HCTX_ACTIVE, &q->queue_flags);
 	} else {
-		if (test_bit(BLK_MQ_S_TAG_ACTIVE, &hctx->state))
+		if (test_bit(BLK_MQ_S_TAG_ACTIVE, &hctx->state) ||
+		    test_and_set_bit(BLK_MQ_S_TAG_ACTIVE, &hctx->state))
 			return;
-		set_bit(BLK_MQ_S_TAG_ACTIVE, &hctx->state);
 	}
 
 	users = atomic_inc_return(&hctx->tags->active_queues);