[PATCH] nvme/pci: fix queue_rqs list splitting

[PATCH] nvme/pci: fix queue_rqs list splitting

[Keith Busch]

If command prep fails, current handling will orphan subsequent requests
in the list. Consider a simple example:

  rqlist = [ 1 -> 2 ]

When prep for request '1' fails, it will be appended to the
'requeue_list', leaving request '2' disconnected from the original
rqlist and no longer tracked. Meanwhile, rqlist is still pointing to the
failed 'req' and will attempt to submit the unprepped command.

Fix this by updating the rqlist accordingly.

Fixes: d62cbcf62f2f ("nvme: add support for mq_ops->queue_rqs()")
Signed-off-by: Keith Busch <kbusch@kernel.org>
---
Just IMO, the rq list manipulation looks a bit fragile for the lld. If
more drivers want to subscribe to the new .queue_rqs() interface, I have
another patch set ready for consideration with helper macros to make
this sort of error handling a little easier for re-use.

 drivers/nvme/host/pci.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 50deb8b69c40..36398fee66c1 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1007,20 +1007,33 @@ static void nvme_queue_rqs(struct request **rqlist)
 
 		if (!nvme_prep_rq_batch(nvmeq, req)) {
 			/* detach 'req' and add to remainder list */
+			struct request *next = rq_list_next(req);
+
 			if (prev)
-				prev->rq_next = req->rq_next;
+				prev->rq_next = next;
+			else
+				*rqlist = next;
+
 			rq_list_add(&requeue_list, req);
-		} else {
+
+			if (prev)
+				req = prev;
+			else
+				req = next;
+		}
+
+		if (req) {
 			prev = req;
+			req = rq_list_next(req);
 		}
 
-		req = rq_list_next(req);
 		if (!req || (prev && req->mq_hctx != prev->mq_hctx)) {
 			/* detach rest of list, and submit */
 			if (prev)
 				prev->rq_next = NULL;
 			nvme_submit_cmds(nvmeq, rqlist);
 			*rqlist = req;
+			prev = NULL;
 		}
 	} while (req);
 
-- 
2.25.4

Re: [PATCH] nvme/pci: fix queue_rqs list splitting

[Jens Axboe]

On 12/22/21 2:41 PM, Keith Busch wrote:
> If command prep fails, current handling will orphan subsequent requests
> in the list. Consider a simple example:
> 
>   rqlist = [ 1 -> 2 ]
> 
> When prep for request '1' fails, it will be appended to the
> 'requeue_list', leaving request '2' disconnected from the original
> rqlist and no longer tracked. Meanwhile, rqlist is still pointing to the
> failed 'req' and will attempt to submit the unprepped command.
> 
> Fix this by updating the rqlist accordingly.

Good catch.

> Just IMO, the rq list manipulation looks a bit fragile for the lld. If
> more drivers want to subscribe to the new .queue_rqs() interface, I have
> another patch set ready for consideration with helper macros to make
> this sort of error handling a little easier for re-use.

I'd love to make it so that the driver didn't need the list manipulation,
but I also don't want to turn it into Yet Another indirect call. We could
potentially do the same trick as was done for:

commit c234a65392062504acf04afe0ae404cca61a8e1a
Author: Jens Axboe <axboe@kernel.dk>
Date:   Fri Oct 8 05:59:37 2021 -0600

    nvme: add support for batched completion of polled IO

where the function pointer is known and gcc turns it into a direct
call instead?

-- 
Jens Axboe

Re: [PATCH] nvme/pci: fix queue_rqs list splitting

[Christoph Hellwig]

On Wed, Dec 22, 2021 at 01:41:59PM -0800, Keith Busch wrote:
>  			/* detach 'req' and add to remainder list */
> +			struct request *next = rq_list_next(req);
> +
>  			if (prev)
> -				prev->rq_next = req->rq_next;
> +				prev->rq_next = next;
> +			else
> +				*rqlist = next;
> +
>  			rq_list_add(&requeue_list, req);
> -		} else {
> +
> +			if (prev)
> +				req = prev;
> +			else
> +				req = next;
> +		}
> +
> +		if (req) {
>  			prev = req;
> +			req = rq_list_next(req);
>  		}

This hunk absolutely needs to go into a helper instead of being open
coded in a driver.