Re: [bug report] BUG kernel BULL pointer at blk_mq_flush_plug_list+0x2c4/0x320 observed with blktests on latest linux-block/for-next

[Ming Lei <ming.lei@redhat.com>]

Hi Yi,

Thanks for the report!

On Mon, Dec 06, 2021 at 09:38:35AM +0800, Yi Zhang wrote:
> This is the first commit that observed this issue.
>        Kernel repo:
> https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux-block.git
>             Commit: c7d61010b991 - Merge branch 'for-5.17/block' into for-next

The issue should be fixed by the following patch:

From 8d30d9a46d4ede16c61ad48c2a1ceaf2ec29d044 Mon Sep 17 00:00:00 2001
From: Ming Lei <ming.lei@redhat.com>
Date: Mon, 6 Dec 2021 11:33:50 +0800
Subject: [PATCH] blk-mq: don't use plug->mq_list->q directly in
 blk_mq_run_dispatch_ops()

blk_mq_run_dispatch_ops() is defined as one macro, and plug->mq_list
will be changed when running 'dispatch_ops', so add one local variable
for holding request queue.

Reported-by: Yi Zhang <yi.zhang@redhat.com>
Fixes: 4cafe86c9267 ("blk-mq: run dispatch lock once in case of issuing from list")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
---
 block/blk-mq.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index 22ec21aa0c22..537295f6e0e9 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2521,7 +2521,9 @@ void blk_mq_flush_plug_list(struct blk_plug *plug, bool from_schedule)
 	plug->rq_count = 0;
 
 	if (!plug->multiple_queues && !plug->has_elevator && !from_schedule) {
-		blk_mq_run_dispatch_ops(plug->mq_list->q,
+		struct request_queue *q = rq_list_peek(&plug->mq_list)->q;
+
+		blk_mq_run_dispatch_ops(q,
 				blk_mq_plug_issue_direct(plug, false));
 		if (rq_list_empty(plug->mq_list))
 			return;
-- 
2.31.1


Thanks, 
Ming