[4.14,37/81] blk-mq: move cancel of requeue_work into blk_mq_release

Commit Message

Greg Kroah-Hartman June 13, 2019, 8:33 a.m. UTC

[ Upstream commit fbc2a15e3433058582e5635aabe48a3011a644a8 ]

With holding queue's kobject refcount, it is safe for driver
to schedule requeue. However, blk_mq_kick_requeue_list() may
be called after blk_sync_queue() is done because of concurrent
requeue activities, then requeue work may not be completed when
freeing queue, and kernel oops is triggered.

So moving the cancel of requeue_work into blk_mq_release() for
avoiding race between requeue and freeing queue.

Cc: Dongli Zhang <[e-mail]>
Cc: James Smart <[e-mail]>
Cc: Bart Van Assche <[e-mail]>
Cc: [e-mail],
Cc: Martin K . Petersen <[e-mail]>,
Cc: Christoph Hellwig <[e-mail]>,
Cc: James E . J . Bottomley <[e-mail]>,
Reviewed-by: Bart Van Assche <[e-mail]>
Reviewed-by: Johannes Thumshirn <[e-mail]>
Reviewed-by: Hannes Reinecke <[e-mail]>
Reviewed-by: Christoph Hellwig <[e-mail]>
Tested-by: James Smart <[e-mail]>
Signed-off-by: Ming Lei <[e-mail]>
Signed-off-by: Jens Axboe <[e-mail]>
Signed-off-by: Sasha Levin <[e-mail]>
---
 block/blk-core.c | 1 -
 block/blk-mq.c   | 2 ++
 2 files changed, 2 insertions(+), 1 deletion(-)

Patch

diff --git a/block/blk-core.c b/block/blk-core.c
index 0b14aebfd1a8..4e04c79aa2c2 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -339,7 +339,6 @@  void blk_sync_queue(struct request_queue *q)
 		struct blk_mq_hw_ctx *hctx;
 		int i;
 
-		cancel_delayed_work_sync(&q->requeue_work);
 		queue_for_each_hw_ctx(q, hctx, i)
 			cancel_delayed_work_sync(&hctx->run_work);
 	} else {
diff --git a/block/blk-mq.c b/block/blk-mq.c
index eac444804736..55139d2fca3e 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2294,6 +2294,8 @@  void blk_mq_release(struct request_queue *q)
 	struct blk_mq_hw_ctx *hctx;
 	unsigned int i;
 
+	cancel_delayed_work_sync(&q->requeue_work);
+
 	/* hctx kobj stays in hctx */
 	queue_for_each_hw_ctx(q, hctx, i) {
 		if (!hctx)