Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Subject: Re: [RFC PATCH v3 1/3] blk-mq: Clean up references to old requests
 when freeing rqs
To:     Khazhy Kumykov <khazhy@google.com>
CC:     <hare@suse.de>, Bart Van Assche <bvanassche@acm.org>,
        <ming.lei@redhat.com>, Jens Axboe <axboe@kernel.dk>, <hch@lst.de>,
        <linux-block@vger.kernel.org>,
        Linux Kernel Mailing List <linux-kernel@vger.kernel.org>,
        <pragalla@codeaurora.org>, <kashyap.desai@broadcom.com>,
        <yuyufen@huawei.com>
References: <1614957294-188540-1-git-send-email-john.garry@huawei.com>
 <1614957294-188540-2-git-send-email-john.garry@huawei.com>
 <CACGdZY+Qft=55Si5Lmjh1RmVb5Roe-KTsrJHJLz0opSXuesTBg@mail.gmail.com>
From:   John Garry <john.garry@huawei.com>
Message-ID: <03e09428-b4e1-c77c-2e00-5b6fd53bf894@huawei.com>
Date:   Mon, 8 Mar 2021 11:18:57 +0000
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:68.0) Gecko/20100101
 Thunderbird/68.1.2
MIME-Version: 1.0
In-Reply-To: <CACGdZY+Qft=55Si5Lmjh1RmVb5Roe-KTsrJHJLz0opSXuesTBg@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 06/03/2021 02:52, Khazhy Kumykov wrote:
> On Fri, Mar 5, 2021 at 7:20 AM John Garry <john.garry@huawei.com> wrote:
>>
>> It has been reported many times that a use-after-free can be intermittently
>> found when iterating busy requests:
>>
>> - https://lore.kernel.org/linux-block/8376443a-ec1b-0cef-8244-ed584b96fa96@huawei.com/
>> - https://lore.kernel.org/linux-block/5c3ac5af-ed81-11e4-fee3-f92175f14daf@acm.org/T/#m6c1ac11540522716f645d004e2a5a13c9f218908
>> - https://lore.kernel.org/linux-block/04e2f9e8-79fa-f1cb-ab23-4a15bf3f64cc@kernel.dk/
>>
>> The issue is that when we switch scheduler or change queue depth, there may
>> be references in the driver tagset to the stale requests.
>>
>> As a solution, clean up any references to those requests in the driver
>> tagset. This is done with a cmpxchg to make safe any race with setting the
>> driver tagset request from another queue.
> 
> I noticed this crash recently when running blktests on a "debug"
> config on a 4.15 based kernel (it would always crash), and backporting
> this change fixes it. (testing on linus's latest tree also confirmed
> the fix, with the same config). I realize I'm late to the
> conversation, but appreciate the investigation and fixes :)

Good to know. I'll explicitly cc you on further versions.

Thanks,
John