Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753480AbbFDNTd (ORCPT ); Thu, 4 Jun 2015 09:19:33 -0400 Received: from mail-ob0-f169.google.com ([209.85.214.169]:33781 "EHLO mail-ob0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753144AbbFDNTa (ORCPT ); Thu, 4 Jun 2015 09:19:30 -0400 MIME-Version: 1.0 In-Reply-To: <1433423645-18901-1-git-send-email-tom.leiming@gmail.com> References: <1433423645-18901-1-git-send-email-tom.leiming@gmail.com> Date: Thu, 4 Jun 2015 21:19:29 +0800 Message-ID: Subject: Re: [PATCH] blk-mq: free hctx->ctxs in queue's release handler From: Ming Lei To: Jens Axboe , Linux Kernel Mailing List Cc: Stefan Seyfried , Ming Lei , NeilBrown , Christoph Hellwig , "v4.0" Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2498 Lines: 77 On Thu, Jun 4, 2015 at 9:14 PM, Ming Lei wrote: > Now blk_cleanup_queue() can be called before calling > del_gendisk()[1], inside which hctx->ctxs is touched > from blk_mq_unregister_hctx(), but the variable has > been freed by blk_cleanup_queue() at that time. > > So this patch moves freeing of hctx->ctxs into queue's > release handler for fixing the oops reported by Stefan. > > Also ctx's kobject is embedded into each ctx pointed by > hctx->ctxs[], which shouldn't have been released so early. Hammm, the above line is wrong and should be removed, and hctx->ctxs[] just stores the pointer of ctx. Jens, if you need v1, please let me know. > > [1], 6cd18e711dd8075 (block: destroy bdi before blockdev is > unregistered) > > Reported-by: Stefan Seyfried > Cc: NeilBrown > Cc: Christoph Hellwig > Cc: stable@vger.kernel.org (v4.0) > Signed-off-by: Ming Lei > --- > block/blk-mq.c | 8 ++++++-- > 1 file changed, 6 insertions(+), 2 deletions(-) > > diff --git a/block/blk-mq.c b/block/blk-mq.c > index e68b71b..594eea0 100644 > --- a/block/blk-mq.c > +++ b/block/blk-mq.c > @@ -1600,6 +1600,7 @@ static int blk_mq_hctx_notify(void *data, unsigned long action, > return NOTIFY_OK; > } > > +/* hctx->ctxs will be freed in queue's release handler */ > static void blk_mq_exit_hctx(struct request_queue *q, > struct blk_mq_tag_set *set, > struct blk_mq_hw_ctx *hctx, unsigned int hctx_idx) > @@ -1618,7 +1619,6 @@ static void blk_mq_exit_hctx(struct request_queue *q, > > blk_mq_unregister_cpu_notifier(&hctx->cpu_notifier); > blk_free_flush_queue(hctx->fq); > - kfree(hctx->ctxs); > blk_mq_free_bitmap(&hctx->ctx_map); > } > > @@ -1891,8 +1891,12 @@ void blk_mq_release(struct request_queue *q) > unsigned int i; > > /* hctx kobj stays in hctx */ > - queue_for_each_hw_ctx(q, hctx, i) > + queue_for_each_hw_ctx(q, hctx, i) { > + if (!hctx) > + continue; > + kfree(hctx->ctxs); > kfree(hctx); > + } > > kfree(q->queue_hw_ctx); > > -- > 1.9.1 > -- Ming Lei -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/