Re: [PATCHv3 0/2] fix sbitmap initialization and null_blk shared tagset behavior

[Nilay Shroff <nilay@linux.ibm.com>]

Hi Jens,

It seems this patchset may have fallen through the cracks. 
It still applies cleanly on the latest mainline code. Could
you please consider pulling it for the 6.18 cycle?

Thanks,
--Nilay

On 7/23/25 7:13 PM, Nilay Shroff wrote:
> Hi,
> 
> This patchset fixes two subtle issues discovered while unit testing
> nr_hw_queue update code using null_blk driver.
> 
> The first patch in the series, fixes an issue in the sbitmap initialization
> code, where sb->alloc_hint is not explicitly set to NULL when the sbitmap
> depth is zero. This can lead to a kernel crash in sbitmap_free(), which
> unconditionally calls free_percpu() on sb->alloc_hint — even if it was
> never allocated. The crash is caused by dereferencing an invalid pointer
> or stale garbage value.
> 
> The second patch in the series, prevents runtime updates to submit_queues
> or poll_queues when using a shared tagset. Currently, such updates lead 
> to the allocation of new hardware queues (hctx) that are never mapped to
> any software queues (ctx), rendering them unusable for I/O. This patch
> rejects these changes and ensures more consistent behavior. Interestingly,
> this unnecessary queue update path helped uncover the issue fixed in first
> patch.
> 
> As usual, review and feedback are most welcome!
> 
> Changes from v2:
>     - Updated the second patch to prevent the user from modifying submit
>       or poll queues when tagset is shared (Damien Le Moal, Yu Kuai)
> Changes from v1:
>     - The set->driver_data field should be initialized separately for the
>       shared tagset to ensure it is correctly set for both shared and
>       non-shared tagset cases. (Damien Le Moal)
> 
> Nilay Shroff (2):
>   lib/sbitmap: fix kernel crash observed when sbitmap depth is zero
>   null_blk: prevent submit and poll queues update for shared tagset
> 
>  drivers/block/null_blk/main.c | 32 ++++++++++++++++++++++----------
>  lib/sbitmap.c                 |  1 +
>  2 files changed, 23 insertions(+), 10 deletions(-)
>