Re: [PATCH] blk-mq: always take a queue reference in blk_mq_submit_bio

[Jens Axboe <axboe@kernel.dk>]

On 5/20/26 2:49 AM, Christoph Hellwig wrote:
> When submitting a bio to blk-mq, if the task should sleep after peeking
> a cached request, but before it pops it, the plug flushes and calls
> blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a
> use-after-free bug.
> 
> Fix this by alway grabbing a queue usage reference in blk_mq_submit_bio.
> While past commit claims that this is slow, we're better safe than
> fast as a first priority.
> 
> The code had already warned of this possibility, and specifically popped
> the request before other known blocking calls, but it didn't handle a
> blocking GFP_NOIO alloc. Under memory pressure, allocating the split bio
> or the integrity payload are two such cases that can block. The blk-mq
> submit_bio function continues using the peeked request that was already
> freed and re-initialized, so the driver receives that request with a
> NULL'ed mq_hctx, and inevitably panics.
> 
> Large parts of the commit message are stolen from an earlier attempt
> to fix this issue by Keith Busch <kbusch@kernel.org>.

This is about a 5% regression in peak performance, fwiw. I'm all for
eliminating this issue, but this kind of big hammer approach is pretty
crap in terms of adding overhead to the IO path. Maybe we just cover
blocking split bio case, and look into doing a proper fix for 7.2 that
isn't such a massive regression?

-- 
Jens Axboe