Hi Ming
Why not add percpu_ref_tryget/put pair into run queue and requeue work,
or before queue the work ?
Then freezing queue could really implement to freeze the queue and there will be
no any queue activity after freeze, including run queue and requeue work.
Thanks
Jianchao
On 4/4/19 4:43 PM, Ming Lei wrote:
> Inside __blk_mq_update_nr_hw_queues(), only request queues are frozen
> before updating nr_hw_queues.
>
> However, even though blk_mq_freeze_queue() is returned, there might be
> run queue activity not completed, then use-after-free may be triggered
> on hctx and its fields.
>
> Fix this issue by really quiescing queue via blk_mq_quiesce_queue() and
> blk_sync_queue() for making sure no any run queue activity pending
> before releasing hctx.
>
> Cc: Dongli Zhang <dongli.zh...@oracle.com>
> Cc: James Smart <james.sm...@broadcom.com>
> Cc: Bart Van Assche <bart.vanass...@wdc.com>
> Cc: linux-scsi@vger.kernel.org,
> Cc: Martin K . Petersen <martin.peter...@oracle.com>,
> Cc: Christoph Hellwig <h...@lst.de>,
> Cc: James E . J . Bottomley <j...@linux.vnet.ibm.com>,
> Cc: jianchao wang <jianchao.w.w...@oracle.com>
> Reported-by: Bart Van Assche <bvanass...@acm.org>
> Signed-off-by: Ming Lei <ming....@redhat.com>
> ---
> block/blk-mq.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index b512ba0cb359..41c12d9008b7 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -3224,8 +3224,11 @@ static void __blk_mq_update_nr_hw_queues(struct
> blk_mq_tag_set *set,
> if (nr_hw_queues < 1 || nr_hw_queues == set->nr_hw_queues)
> return;
>
> - list_for_each_entry(q, &set->tag_list, tag_set_list)
> + list_for_each_entry(q, &set->tag_list, tag_set_list) {
> blk_mq_freeze_queue(q);
> + blk_mq_quiesce_queue(q);
> + blk_sync_queue(q);
> + }
> /*
> * Sync with blk_mq_queue_tag_busy_iter.
> */
> @@ -3269,8 +3272,10 @@ static void __blk_mq_update_nr_hw_queues(struct
> blk_mq_tag_set *set,
> list_for_each_entry(q, &set->tag_list, tag_set_list)
> blk_mq_elv_switch_back(&head, q);
>
> - list_for_each_entry(q, &set->tag_list, tag_set_list)
> + list_for_each_entry(q, &set->tag_list, tag_set_list) {
> + blk_mq_unquiesce_queue(q);
> blk_mq_unfreeze_queue(q);
> + }
> }
>
> void blk_mq_update_nr_hw_queues(struct blk_mq_tag_set *set, int nr_hw_queues)
>
