bio linked list corruption.

Commit Message

Jens Axboe Oct. 26, 2016, 11:05 p.m. UTC

On 10/26/2016 05:01 PM, Dave Jones wrote:
> On Wed, Oct 26, 2016 at 03:51:01PM -0700, Linus Torvalds wrote:
>  > Dave: it might be a good idea to split that "WARN_ON_ONCE()" in
>  > blk_mq_merge_queue_io() into two, since right now it can trigger both
>  > for the
>  >
>  >                 blk_mq_bio_to_request(rq, bio);
>  >
>  > path _and_ for the
>  >
>  >                 if (!blk_mq_attempt_merge(q, ctx, bio)) {
>  >                         blk_mq_bio_to_request(rq, bio);
>  >                         goto insert_rq;
>  >
>  > path. If you split it into two: one before that "insert_rq:" label,
>  > and one before the "goto insert_rq" thing, then we could see if it is
>  > just one of the blk_mq_merge_queue_io() cases (or both) that is
>  > broken..
>
> It's the latter of the two.
>
> [   12.302392] WARNING: CPU: 3 PID: 272 at block/blk-mq.c:1191
> blk_sq_make_request+0x320/0x4d0

I would expect that - so normal request, since we know merging is on. I
just sent out a patch, can you give that a whirl?

Keep Linus' debugging patch, and apply it on top. Below as well, for
reference.

Patch

diff --git a/block/blk-mq.c b/block/blk-mq.c
index ddc2eed64771..80a9c45a9235 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1217,9 +1217,7 @@  static struct request *blk_mq_map_request(struct 
request_queue *q,
  	blk_mq_set_alloc_data(&alloc_data, q, 0, ctx, hctx);
  	rq = __blk_mq_alloc_request(&alloc_data, op, op_flags);

-	hctx->queued++;
-	data->hctx = hctx;
-	data->ctx = ctx;
+	data->hctx->queued++;
  	return rq;
  }