[PATCH] ublk: don't queue request if the associated uring_cmd is canceled

[PATCH] ublk: don't queue request if the associated uring_cmd is canceled

[Ming Lei]

Commit 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task")
need to dereference `io->cmd` for checking if the IO can be added to current
batch, see ublk_belong_to_same_batch() and io_uring_cmd_ctx_handle(). However,
`io->cmd` may become invalid after the uring_cmd is canceled.

Fixes it by only allowing to queue this IO in case that ublk_prep_req()
returns `BLK_STS_OK`, when 'io->cmd' is guaranteed to be valid.

Reported-by: Changhui Zhong <czhong@redhat.com>
Fixes: 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
---
 drivers/block/ublk_drv.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index c3e3c3b65a6d..9fd284fa76dc 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1442,15 +1442,16 @@ static void ublk_queue_rqs(struct rq_list *rqlist)
 		struct ublk_queue *this_q = req->mq_hctx->driver_data;
 		struct ublk_io *this_io = &this_q->ios[req->tag];
 
+		if (ublk_prep_req(this_q, req, true) != BLK_STS_OK) {
+			rq_list_add_tail(&requeue_list, req);
+			continue;
+		}
+
 		if (io && !ublk_belong_to_same_batch(io, this_io) &&
 				!rq_list_empty(&submit_list))
 			ublk_queue_cmd_list(io, &submit_list);
 		io = this_io;
-
-		if (ublk_prep_req(this_q, req, true) == BLK_STS_OK)
-			rq_list_add_tail(&submit_list, req);
-		else
-			rq_list_add_tail(&requeue_list, req);
+		rq_list_add_tail(&submit_list, req);
 	}
 
 	if (!rq_list_empty(&submit_list))
-- 
2.47.1

Re: [PATCH] ublk: don't queue request if the associated uring_cmd is canceled

[Jens Axboe]

On Tue, 01 Jul 2025 15:23:25 +0800, Ming Lei wrote:
> Commit 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task")
> need to dereference `io->cmd` for checking if the IO can be added to current
> batch, see ublk_belong_to_same_batch() and io_uring_cmd_ctx_handle(). However,
> `io->cmd` may become invalid after the uring_cmd is canceled.
> 
> Fixes it by only allowing to queue this IO in case that ublk_prep_req()
> returns `BLK_STS_OK`, when 'io->cmd' is guaranteed to be valid.
> 
> [...]

Applied, thanks!

[1/1] ublk: don't queue request if the associated uring_cmd is canceled
      commit: 01ed88aea527e19def9070349399684522c66c72

Best regards,
-- 
Jens Axboe

Re: [PATCH] ublk: don't queue request if the associated uring_cmd is canceled

[Changhui Zhong]

On Tue, Jul 1, 2025 at 3:23 PM Ming Lei <ming.lei@redhat.com> wrote:
>
> Commit 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task")
> need to dereference `io->cmd` for checking if the IO can be added to current
> batch, see ublk_belong_to_same_batch() and io_uring_cmd_ctx_handle(). However,
> `io->cmd` may become invalid after the uring_cmd is canceled.
>
> Fixes it by only allowing to queue this IO in case that ublk_prep_req()
> returns `BLK_STS_OK`, when 'io->cmd' is guaranteed to be valid.
>
> Reported-by: Changhui Zhong <czhong@redhat.com>
> Fixes: 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task")
> Signed-off-by: Ming Lei <ming.lei@redhat.com>
> ---
>  drivers/block/ublk_drv.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
> index c3e3c3b65a6d..9fd284fa76dc 100644
> --- a/drivers/block/ublk_drv.c
> +++ b/drivers/block/ublk_drv.c
> @@ -1442,15 +1442,16 @@ static void ublk_queue_rqs(struct rq_list *rqlist)
>                 struct ublk_queue *this_q = req->mq_hctx->driver_data;
>                 struct ublk_io *this_io = &this_q->ios[req->tag];
>
> +               if (ublk_prep_req(this_q, req, true) != BLK_STS_OK) {
> +                       rq_list_add_tail(&requeue_list, req);
> +                       continue;
> +               }
> +
>                 if (io && !ublk_belong_to_same_batch(io, this_io) &&
>                                 !rq_list_empty(&submit_list))
>                         ublk_queue_cmd_list(io, &submit_list);
>                 io = this_io;
> -
> -               if (ublk_prep_req(this_q, req, true) == BLK_STS_OK)
> -                       rq_list_add_tail(&submit_list, req);
> -               else
> -                       rq_list_add_tail(&requeue_list, req);
> +               rq_list_add_tail(&submit_list, req);
>         }
>
>         if (!rq_list_empty(&submit_list))
> --
> 2.47.1
>
Hi,Ming

run tests 40 times with your fix patch, not hit kernel oops issue.

Tested-by: Changhui Zhong <czhong@redhat.com>

Re: [PATCH] ublk: don't queue request if the associated uring_cmd is canceled

[Caleb Sander Mateos]

On Tue, Jul 1, 2025 at 3:23 AM Ming Lei <ming.lei@redhat.com> wrote:
>
> Commit 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task")
> need to dereference `io->cmd` for checking if the IO can be added to current
> batch, see ublk_belong_to_same_batch() and io_uring_cmd_ctx_handle(). However,
> `io->cmd` may become invalid after the uring_cmd is canceled.
>
> Fixes it by only allowing to queue this IO in case that ublk_prep_req()
> returns `BLK_STS_OK`, when 'io->cmd' is guaranteed to be valid.
>
> Reported-by: Changhui Zhong <czhong@redhat.com>
> Fixes: 524346e9d79f ("ublk: build batch from IOs in same io_ring_ctx and io task")
> Signed-off-by: Ming Lei <ming.lei@redhat.com>

Reviewed-by: Caleb Sander Mateos <csander@purestorage.com>