Messages in this thread | | | Subject | Re: [RFC PATCH v3 1/3] blk-mq: Clean up references to old requests when freeing rqs | From | Bart Van Assche <> | Date | Sat, 6 Mar 2021 10:13:11 -0800 |
| |
On 3/5/21 7:14 AM, John Garry wrote: > @@ -2296,10 +2296,14 @@ void blk_mq_free_rqs(struct blk_mq_tag_set *set, struct blk_mq_tags *tags, > > for (i = 0; i < tags->nr_tags; i++) { > struct request *rq = tags->static_rqs[i]; > + int j; > > if (!rq) > continue; > set->ops->exit_request(set, rq, hctx_idx); > + /* clean up any references which occur in @ref_tags */ > + for (j = 0; ref_tags && j < ref_tags->nr_tags; j++) > + cmpxchg(&ref_tags->rqs[j], rq, 0); > tags->static_rqs[i] = NULL; > } > }
What prevents blk_mq_tagset_busy_iter() from reading hctx->tags[...] before the cmpxcg() call and dereferencing it after blk_mq_free_rqs() has called __free_pages()?
Thanks,
Bart.
| |