On Wed, 2017-03-15 at 20:40 +0800, Ming Lei wrote: > On Wed, Mar 15, 2017 at 08:18:53PM +0800, Ming Lei wrote: > > On Wed, Mar 15, 2017 at 12:07:37AM +0000, Bart Van Assche wrote: > > > > > or __blk_mq_requeue_request(). Another issue with this function is that the > > > > __blk_mq_requeue_request() can be run from two pathes: > > > > - dispatch failure, in which case the req/tag isn't released to tag set > > > > - IO completion path, in which COMPLETE flag is cleared before requeue. > > > > so I can't see races with timeout in case of start rq vs. requeue rq. > > Actually rq/tag won't be released to tag set if it will be requeued, so > the timeout race is nothing to do with requeue. Hello Ming, Please have another look at __blk_mq_requeue_request(). In that function the following code occurs: if (test_and_clear_bit(REQ_ATOM_STARTED, &rq->atomic_flags)) { ... } I think the REQ_ATOM_STARTED check in blk_mq_check_expired() races with the test_and_clear_bit(REQ_ATOM_STARTED, &rq->atomic_flags) call in __blk_mq_requeue_request(). Bart.