Patch "block: ensure we hold a queue reference when using queue limits" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    block: ensure we hold a queue reference when using queue limits

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     block-ensure-we-hold-a-queue-reference-when-using-qu.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 759328c0a8bf2120a9d1e7eae9e89a8529d81043
Author: Jens Axboe <axboe@xxxxxxxxx>
Date:   Fri Jan 12 09:12:20 2024 -0700

    block: ensure we hold a queue reference when using queue limits
    
    [ Upstream commit 7b4f36cd22a65b750b4cb6ac14804fb7d6e6c67d ]
    
    q_usage_counter is the only thing preventing us from the limits changing
    under us in __bio_split_to_limits, but blk_mq_submit_bio doesn't hold
    it while calling into it.
    
    Move the splitting inside the region where we know we've got a queue
    reference. Ideally this could still remain a shared section of code, but
    let's keep the fix simple and defer any refactoring here to later.
    
    Reported-by: Christoph Hellwig <hch@xxxxxx>
    Fixes: 900e08075202 ("block: move queue enter logic into blk_mq_submit_bio()")
    Reviewed-by: Christoph Hellwig <hch@xxxxxx>
    Reviewed-by: Ming Lei <ming.lei@xxxxxxxxxx>
    Signed-off-by: Jens Axboe <axboe@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 20ecd0ab616f..6041e17492ec 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2968,12 +2968,6 @@ void blk_mq_submit_bio(struct bio *bio)
 	blk_status_t ret;
 
 	bio = blk_queue_bounce(bio, q);
-	if (bio_may_exceed_limits(bio, &q->limits)) {
-		bio = __bio_split_to_limits(bio, &q->limits, &nr_segs);
-		if (!bio)
-			return;
-	}
-
 	bio_set_ioprio(bio);
 
 	if (plug) {
@@ -2982,6 +2976,11 @@ void blk_mq_submit_bio(struct bio *bio)
 			rq = NULL;
 	}
 	if (rq) {
+		if (unlikely(bio_may_exceed_limits(bio, &q->limits))) {
+			bio = __bio_split_to_limits(bio, &q->limits, &nr_segs);
+			if (!bio)
+				return;
+		}
 		if (!bio_integrity_prep(bio))
 			return;
 		if (blk_mq_attempt_bio_merge(q, bio, nr_segs))
@@ -2992,6 +2991,11 @@ void blk_mq_submit_bio(struct bio *bio)
 	} else {
 		if (unlikely(bio_queue_enter(bio)))
 			return;
+		if (unlikely(bio_may_exceed_limits(bio, &q->limits))) {
+			bio = __bio_split_to_limits(bio, &q->limits, &nr_segs);
+			if (!bio)
+				goto fail;
+		}
 		if (!bio_integrity_prep(bio))
 			goto fail;
 	}