[5.1,070/155] blk-mq: move cancel of requeue_work into blk_mq_release

Commit Message

Greg Kroah-Hartman June 13, 2019, 8:33 a.m. UTC

[ Upstream commit fbc2a15e3433058582e5635aabe48a3011a644a8 ]

With holding queue's kobject refcount, it is safe for driver
to schedule requeue. However, blk_mq_kick_requeue_list() may
be called after blk_sync_queue() is done because of concurrent
requeue activities, then requeue work may not be completed when
freeing queue, and kernel oops is triggered.

So moving the cancel of requeue_work into blk_mq_release() for
avoiding race between requeue and freeing queue.

Cc: Dongli Zhang <[e-mail]>
Cc: James Smart <[e-mail]>
Cc: Bart Van Assche <[e-mail]>
Cc: [e-mail],
Cc: Martin K . Petersen <[e-mail]>,
Cc: Christoph Hellwig <[e-mail]>,
Cc: James E . J . Bottomley <[e-mail]>,
Reviewed-by: Bart Van Assche <[e-mail]>
Reviewed-by: Johannes Thumshirn <[e-mail]>
Reviewed-by: Hannes Reinecke <[e-mail]>
Reviewed-by: Christoph Hellwig <[e-mail]>
Tested-by: James Smart <[e-mail]>
Signed-off-by: Ming Lei <[e-mail]>
Signed-off-by: Jens Axboe <[e-mail]>
Signed-off-by: Sasha Levin <[e-mail]>
---
 block/blk-core.c | 1 -
 block/blk-mq.c   | 2 ++
 2 files changed, 2 insertions(+), 1 deletion(-)

Patch

diff --git a/block/blk-core.c b/block/blk-core.c
index b375cfea024c..2dd94b3e9ece 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -237,7 +237,6 @@  void blk_sync_queue(struct request_queue *q)
 		struct blk_mq_hw_ctx *hctx;
 		int i;
 
-		cancel_delayed_work_sync(&q->requeue_work);
 		queue_for_each_hw_ctx(q, hctx, i)
 			cancel_delayed_work_sync(&hctx->run_work);
 	}
diff --git a/block/blk-mq.c b/block/blk-mq.c
index 8a41cc5974fe..11efca3534ad 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -2666,6 +2666,8 @@  void blk_mq_release(struct request_queue *q)
 	struct blk_mq_hw_ctx *hctx;
 	unsigned int i;
 
+	cancel_delayed_work_sync(&q->requeue_work);
+
 	/* hctx kobj stays in hctx */
 	queue_for_each_hw_ctx(q, hctx, i) {
 		if (!hctx)