Hi Ming Why not add percpu_ref_tryget/put pair into run queue and requeue work, or before queue the work ?
Then freezing queue could really implement to freeze the queue and there will be no any queue activity after freeze, including run queue and requeue work. Thanks Jianchao On 4/4/19 4:43 PM, Ming Lei wrote: > Inside __blk_mq_update_nr_hw_queues(), only request queues are frozen > before updating nr_hw_queues. > > However, even though blk_mq_freeze_queue() is returned, there might be > run queue activity not completed, then use-after-free may be triggered > on hctx and its fields. > > Fix this issue by really quiescing queue via blk_mq_quiesce_queue() and > blk_sync_queue() for making sure no any run queue activity pending > before releasing hctx. > > Cc: Dongli Zhang <[email protected]> > Cc: James Smart <[email protected]> > Cc: Bart Van Assche <[email protected]> > Cc: [email protected], > Cc: Martin K . Petersen <[email protected]>, > Cc: Christoph Hellwig <[email protected]>, > Cc: James E . J . Bottomley <[email protected]>, > Cc: jianchao wang <[email protected]> > Reported-by: Bart Van Assche <[email protected]> > Signed-off-by: Ming Lei <[email protected]> > --- > block/blk-mq.c | 9 +++++++-- > 1 file changed, 7 insertions(+), 2 deletions(-) > > diff --git a/block/blk-mq.c b/block/blk-mq.c > index b512ba0cb359..41c12d9008b7 100644 > --- a/block/blk-mq.c > +++ b/block/blk-mq.c > @@ -3224,8 +3224,11 @@ static void __blk_mq_update_nr_hw_queues(struct > blk_mq_tag_set *set, > if (nr_hw_queues < 1 || nr_hw_queues == set->nr_hw_queues) > return; > > - list_for_each_entry(q, &set->tag_list, tag_set_list) > + list_for_each_entry(q, &set->tag_list, tag_set_list) { > blk_mq_freeze_queue(q); > + blk_mq_quiesce_queue(q); > + blk_sync_queue(q); > + } > /* > * Sync with blk_mq_queue_tag_busy_iter. > */ > @@ -3269,8 +3272,10 @@ static void __blk_mq_update_nr_hw_queues(struct > blk_mq_tag_set *set, > list_for_each_entry(q, &set->tag_list, tag_set_list) > blk_mq_elv_switch_back(&head, q); > > - list_for_each_entry(q, &set->tag_list, tag_set_list) > + list_for_each_entry(q, &set->tag_list, tag_set_list) { > + blk_mq_unquiesce_queue(q); > blk_mq_unfreeze_queue(q); > + } > } > > void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues) >
