From: Nilay Shroff <nilay@linux.ibm.com>
To: Zizhi Wo <wozizhi@huaweicloud.com>,
axboe@kernel.dk, dlemoal@kernel.org, kch@nvidia.com,
johannes.thumshirn@wdc.com, kbusch@kernel.org,
bvanassche@acm.org, linux-block@vger.kernel.org
Cc: linux-kernel@vger.kernel.org, yangerkun@huawei.com,
chengzhihao1@huawei.com, wozizhi@huawei.com
Subject: Re: [PATCH V5 7/9] null_blk: reject per-device queue resize for shared tag set
Date: Wed, 15 Jul 2026 19:12:48 +0530 [thread overview]
Message-ID: <f024ffe7-4c49-4c8a-bd79-48f58ab06ebb@linux.ibm.com> (raw)
In-Reply-To: <20260714041805.1088702-8-wozizhi@huaweicloud.com>
On 7/14/26 9:48 AM, Zizhi Wo wrote:
> When shared_tags is enabled, null_setup_tagset() makes the device use the
> global tag_set, whose driver_data stays NULL. null_map_queues() therefore
> falls back to the module-wide g_submit_queues/g_poll_queues instead of any
> per-device value.
>
> Resizing submit_queues or poll_queues via configfs on such a device calls
> blk_mq_update_nr_hw_queues() on the shared set, shrinking
> set->nr_hw_queues. __blk_mq_realloc_hw_ctxs() only grows the
> q->queue_hw_ctx[] allocation, so on shrink it merely exits and NULLs the
> now-excess hctx slots. null_map_queues(), however, keeps mapping CPUs with
> the unchanged g_submit_queues/g_poll_queues, so mq_map[] ends up pointing
> at those NULLed hctx slots. blk_mq_map_swqueue() then dereferences the NULL
> hctx (hctx->cpumask), crashing the kernel:
Looks good to me.
Reviewed-by: Nilay Shroff <nilay@linux.ibm.com>
next prev parent reply other threads:[~2026-07-15 13:43 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-14 4:17 [PATCH V5 0/9] null_blk: fix init/exit races and memleaks Zizhi Wo
2026-07-14 4:17 ` [PATCH V5 1/9] null_blk: use DEFINE_MUTEX for the file-scope mutex Zizhi Wo
2026-07-14 4:17 ` [PATCH V5 2/9] null_blk: register configfs subsystem after creating default devices Zizhi Wo
2026-07-14 4:17 ` [PATCH V5 3/9] null_blk: move unregister_blkdev() after destroying dev in null_exit() Zizhi Wo
2026-07-14 4:18 ` [PATCH V5 4/9] null_blk: free global tag_set on init error path Zizhi Wo
2026-07-14 4:18 ` [PATCH V5 5/9] null_blk: free zones array on device power-off Zizhi Wo
2026-07-15 14:14 ` Nilay Shroff
2026-07-14 4:18 ` [PATCH V5 6/9] null_blk: clean up null_del_dev() to use cached dev pointer Zizhi Wo
2026-07-14 4:18 ` [PATCH V5 7/9] null_blk: reject per-device queue resize for shared tag set Zizhi Wo
2026-07-15 13:42 ` Nilay Shroff [this message]
2026-07-14 4:18 ` [PATCH V5 8/9] null_blk: serialize configfs attribute stores with device setup Zizhi Wo
2026-07-14 4:18 ` [PATCH V5 9/9] null_blk: serialize configfs attribute shows with the file-scope lock Zizhi Wo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=f024ffe7-4c49-4c8a-bd79-48f58ab06ebb@linux.ibm.com \
--to=nilay@linux.ibm.com \
--cc=axboe@kernel.dk \
--cc=bvanassche@acm.org \
--cc=chengzhihao1@huawei.com \
--cc=dlemoal@kernel.org \
--cc=johannes.thumshirn@wdc.com \
--cc=kbusch@kernel.org \
--cc=kch@nvidia.com \
--cc=linux-block@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=wozizhi@huawei.com \
--cc=wozizhi@huaweicloud.com \
--cc=yangerkun@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox