Re: [PATCH V4 3/4] blk-mq: clear stale request in tags->rq[] before freeing one request pool

David Jeffery
2021-04-29T14:03:07Z

On Thu, Apr 29, 2021 at 10:34:57AM +0800, Ming Lei wrote:
>
> refcount_inc_not_zero() in bt_tags_iter() still may read one freed
> request.
>
> Fix the issue by the following approach:
>
> 1) hold a per-tags spinlock when reading ->rqs[tag] and calling
> refcount_inc_not_zero in bt_tags_iter()
>
> 2) clearing stale request referred via ->rqs[tag] before freeing
> request pool, the per-tags spinlock is held for clearing stale
> ->rq[tag]
>
> So after we cleared stale requests, bt_tags_iter() won't observe
> freed request any more, also the clearing will wait for pending
> request reference.
>
> The idea of clearing ->rqs[] is borrowed from John Garry's previous
> patch and one recent David's patch.

With the flush request handled in a separate patch, this looks good to me.

Reviewed-by: David Jeffery <djeffery@redhat.com>