From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793209906; b=BDk+WFg38s77e6MzjlOkSeoNiF0QkqYPhpOGJcjnFiWO4t1SFTzPty7YeIASPu9K3X8/ 88f1WNWQjyEfuPaf1WtWCcPVm0PnL7XJjzKD+AeVDNQ9tBYx5wdENo8L9Gro1x1gNeTXj gLRHgbdaZhShOaKtw1Di+Qa4rYRSZ38X03S/0EHYc/2T55R60CtywHKaykmtq7a5wcHF3 vm6MqrUcISBAwWviqVO9aY9cshM3WQz7KGyIK6g+LQ+TxtdWP0lgjBOLP+OzN0jwoqlv6 tjkQDhAHT1WQnFa5nHjtdtgSxTwOewR3RSqOK8EvYWNwIioBuDvtBMJiL4pKX1Zn36w== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793209906; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=pH5oGT/rSCDg6Wv7vzL7TQEpzQhTM/XMX2UtipqJm0g=; b=xDpB2vyZAHjb0NIBo62Djl/uWMkil9ES2ZR85sNzRebKcUQOLmJf6mAWbJCYtuWeEySo GOczgM7WDLgpdDxPQ81W+cw2jevJLzmjSgJPJEHAEjms8MsXOlstmCL563XbEdkL1aHzk 53MaWwdezpMHR5mzEHW15dSrI6HacuFGMcqrMIQG5c8tFrQvO5GG9L73zEe5lk+PUpm3i 72L+qfXM4VNPFZqPtZ52XDGHRHn28rvjxyCgdD+rge7IuxXzFXrrkKw/4SDA/MAQLyA4j aN/q6SNGk9RXaQn3/OKs0iIh0krHlxcGrfUXjPXfadCcnVW9x0hIVva4M51qyJEleiw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=xhQximKY; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AA165606A323; Wed, 28 Oct 2026 17:51:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=xhQximKY Received: by smtp.kernel.org (Postfix) with ESMTPSA id C41B51F01829; Wed, 28 Oct 2026 17:51:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793209905; bh=pH5oGT/rSCDg6Wv7vzL7TQEpzQhTM/XMX2UtipqJm0g=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=xhQximKYV2zaj/afy/EeM9oMMfIfqMUdSPsX7083IRB6TM0CaKecLY9sRjs3ZI4Az xV32jRQ8fYO2So1lTHsXZG8rOq35OqoCgU/0yRhAu54xsDut1EtbNgcrd7oE2FQgIV b4EwBoMHsOIwrIFUIrItw5dqBJXaBqB8a7rL+rYw= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Keith Busch , Jens Axboe , Artem Dinaburg , Sasha Levin Subject: [PATCH 6.6 001/168] blk-mq: pop cached request if it is usable Date: Wed, 28 Oct 2026 17:58:57 +0100 Message-ID: <20261028165943.128500505@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028165943.089486480@linuxfoundation.org> References: <20261028165943.089486480@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Keith Busch [ Upstream commit dc278e9bf2b9513a763353e6b9cc21e0f532954e ] When submitting a bio to blk-mq, if the task should sleep after peeking a cached request, but before it pops it, the plug flushes and calls blk_mq_free_plug_rqs, freeing the cached_rqs. This creates a use-after-free bug. Fix this by popping the cached request before any possible blocking calls if it is suitable for use. Popping this request first holds a queue reference, so avoid any serialization races with queue freezes and can safely proceed with dispatching that request to the driver. This potentially increases a timing window from when a driver wants to freeze its queue to when requests stop being dispatched. That scenario is off the fast path though, and drivers need to appropriately handle requests during a freeze request anyway. The downside is the popped element needs to be individually freed when we performed a bio plug merge. The cached request would have had to be freed later anyway, but this patch does it inline with building the plug list instead of after flushing it. Fixes: b0077e269f6c1 ("blk-mq: make sure active queue usage is held for bio_integrity_prep()") Fixes: 7b4f36cd22a65 ("block: ensure we hold a queue reference when using queue limits") Signed-off-by: Keith Busch Link: https://patch.msgid.link/20260521190253.242065-1-kbusch@meta.com Signed-off-by: Jens Axboe Assisted-by: LLM [ Backport to 6.6.y: Pop a suitable request from the older cached_rq list before fallible preparation, then initialize it after preparation. The target has three preparation or merge exits; the following correction restores the request on each exit. ] Signed-off-by: Artem Dinaburg Signed-off-by: Sasha Levin --- block/blk-mq.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 4c1c5a261d0cf..1ad77737b27d3 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2984,17 +2984,7 @@ static bool blk_mq_can_use_cached_rq(struct request *rq, struct blk_plug *plug, if (op_is_flush(rq->cmd_flags) != op_is_flush(bio->bi_opf)) return false; - /* - * If any qos ->throttle() end up blocking, we will have flushed the - * plug and hence killed the cached_rq list as well. Pop this entry - * before we throttle. - */ plug->cached_rq = rq_list_next(rq); - rq_qos_throttle(rq->q, bio); - - blk_mq_rq_time_init(rq, 0); - rq->cmd_flags = bio->bi_opf; - INIT_LIST_HEAD(&rq->queuelist); return true; } @@ -3027,20 +3017,30 @@ void blk_mq_submit_bio(struct bio *bio) rq = rq_list_peek(&plug->cached_rq); if (rq && rq->q != q) rq = NULL; + if (rq && !blk_mq_can_use_cached_rq(rq, plug, bio)) + rq = NULL; } if (rq) { if (unlikely(bio_may_exceed_limits(bio, &q->limits))) { bio = __bio_split_to_limits(bio, &q->limits, &nr_segs); - if (!bio) + if (!bio) { + blk_mq_free_request(rq); return; + } } - if (!bio_integrity_prep(bio)) + if (!bio_integrity_prep(bio)) { + blk_mq_free_request(rq); return; - if (blk_mq_attempt_bio_merge(q, bio, nr_segs)) + } + if (blk_mq_attempt_bio_merge(q, bio, nr_segs)) { + blk_mq_free_request(rq); return; - if (blk_mq_can_use_cached_rq(rq, plug, bio)) - goto done; - percpu_ref_get(&q->q_usage_counter); + } + rq_qos_throttle(rq->q, bio); + blk_mq_rq_time_init(rq, 0); + rq->cmd_flags = bio->bi_opf; + INIT_LIST_HEAD(&rq->queuelist); + goto done; } else { if (unlikely(bio_queue_enter(bio))) return; -- 2.53.0