Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Lei Lei2 Yin <yinlei2@lenovo.com>
To:     "kbusch@kernel.org" <kbusch@kernel.org>,
        "axboe@fb.com" <axboe@fb.com>, "hch@lst.de" <hch@lst.de>,
        Sagi Grimberg <sagi@grimberg.me>
CC:     "linux-nvme@lists.infradead.org" <linux-nvme@lists.infradead.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        "cybeyond@foxmail.com" <cybeyond@foxmail.com>
Subject: [PATCH] nvme: fix double blk_mq_complete_request for timeout request
 with low probability
Thread-Topic: [PATCH] nvme: fix double blk_mq_complete_request for timeout
 request with low probability
Thread-Index: AdlookLWDq+ZQ4LKSB+WnMnjqCG8eg==
Date:   Thu, 6 Apr 2023 16:18:18 +0000
Message-ID: <PS1PR03MB4939C825BD5D9A135AA0EB9188919@PS1PR03MB4939.apcprd03.prod.outlook.com>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
x-ms-exchange-antispam-messagedata-chunkcount: 1
x-ms-exchange-antispam-messagedata-0: =?us-ascii?Q?RBQ8sFZEEMd44WeGSBmPAqsXKSaCQxAAyaMugMuUuLtMeElWi3I6c+cb1tEA?=
 =?us-ascii?Q?NuNU9Aj+3kUXPeMawMPWRhpJ3aGWthsZNrL6kGYEgvarPfJyKrEOZqszzUW3?=
 =?us-ascii?Q?ajYfpM5n4ZDcU7fpjHz/nKYwrVvF/iMjQnzIEaIlqNlZIKYLVvBnxhArANWM?=
 =?us-ascii?Q?Y1dt5u/bYr/HXFUPwLdpdQutdlKTVOlG1E/JZq0Ua5JgucMpSek2ZkYMT8KX?=
 =?us-ascii?Q?8PFuxugS9VfyIxX6mCbqiczeGdC69beM3KyGwGfUo+tq26q4J4xjz5kOdvj5?=
 =?us-ascii?Q?o6eLKXEHlIwLo3jDKLuu2n3K7ACESmzbuBB6LN806I7KX55DkMHkBsw8SFRI?=
 =?us-ascii?Q?Gr7ez/4082Y6eXMntURBMcJyFlRMp5pumCkjUeomoCjucX7tHlsMy00TLIsU?=
 =?us-ascii?Q?+VkB346opsYadJMeOg11kdoAMp6ou7//RxVG886jXbgmDlvVqx6At3hz4wqJ?=
 =?us-ascii?Q?YiKIdf1VysVaYTh2oVj6JP4R4IiOMcqgMmtTYF3fojN6jLFenN1T2aBwTDY0?=
 =?us-ascii?Q?Q3EICNJayt/pHV7a7uoMDhx2NA+Pt+4Oj92nHrzV8chI/WfCnVp4iyUUGE8x?=
 =?us-ascii?Q?nvIowGSHwwpp5DtSv0xy/wzTA+NZp85RlwW4I+2+oQXe8T0orptfj1iDIO4G?=
 =?us-ascii?Q?g0ySE6lb9oPQA8Oz/UpcjSD2zrNGO+n3SCiAOgnmzDnWZIjVNDc2BlAsxfo4?=
 =?us-ascii?Q?+QKIx858FtGdkbOzbsxe2bXBupx89y4KtgGLiec2zcswl/o1EbwipVaNDFCP?=
 =?us-ascii?Q?KJWJcyg/bTHymifdbLudApBIzw/qs+3Yeve1WT7bSHq9q6xDePv70HZCHuHs?=
 =?us-ascii?Q?FGr8CkIyDxwJKwYvWia9MnambTTOcVS81ebJIoPj88caSZtSb+NhNQe0X6T7?=
 =?us-ascii?Q?Lo/XuYbiM7uaVqFj4pp/rWrJYPiBF2yEZ3CK07gvBRKYoZXZFLA/J4CR9vGu?=
 =?us-ascii?Q?N76PTnSODf1WyRelcMhk9y10zR1lnqGnA9mh4WDjMi2IzBbHXvlxZ5yHOIPz?=
 =?us-ascii?Q?jDt6iQjfGrEtHDfj0JzLblrM2W4mg4qbLyP7XDvEMSfziooawQmHktaAE6ZU?=
 =?us-ascii?Q?Yh24coCcST+WmqO/IuNRWKg6MdSKsGm3cRPzbjvlv1uuW8aVrRpQD9bDo6pU?=
 =?us-ascii?Q?J+CzGPtSXubq2toB0NYlae3hDHUw0ilNpHcg1+U8YJ6ky2Oc/eZY34UH/VUd?=
 =?us-ascii?Q?gFIdr0r3kMHT2I8/fj2nLCPWBlW0oUNjlN4WIaasnOdYUX6Uc1rbX1QcbMip?=
 =?us-ascii?Q?ZHIpDp7tN3fNS0UTDwsBzJl78UustmBALIIZDmJhy+Hrn1FfOq4T27XuvOnG?=
 =?us-ascii?Q?WikrI91K2AMg1+9csVfS23a9IPoZcPTFQvsRb89+le10WeoDv5iSCCaF/gBP?=
 =?us-ascii?Q?I2It2k1Zb0itRwLUHRIvrZidP1gWGhIQCtl+MZZqdmSYYvBK/rDp8s/Lu8Zz?=
 =?us-ascii?Q?iP+OQUslth6QdwbQCS4b1raBz7R4s1afH4zamlC2dDepnfmNt5eN2flg4z9I?=
 =?us-ascii?Q?chw6IY4f5gfkanCjH4gR04BCxknABHqC42ZyOohbauU2wiL3pH4JR0bTwTVV?=
 =?us-ascii?Q?qrvpNwNh8M9ewiuYmOs=3D?=
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
X-OriginatorOrg: lenovo.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-AuthSource: PS1PR03MB4939.apcprd03.prod.outlook.com
X-MS-Exchange-CrossTenant-Network-Message-Id: cbf169fe-d686-4b31-7e38-08db36ba886b
X-MS-Exchange-CrossTenant-originalarrivaltime: 06 Apr 2023 16:18:18.3056
 (UTC)
X-MS-Exchange-CrossTenant-fromentityheader: Hosted
X-MS-Exchange-CrossTenant-id: 5c7d0b28-bdf8-410c-aa93-4df372b16203
X-MS-Exchange-CrossTenant-mailboxtype: HOSTED
X-MS-Exchange-CrossTenant-userprincipalname: Pt9oB/GTpoe+xof8I+n2PlWaS5t95R8so650/j/Wlt7SBs0yxRgmDOXeqi/+b3EnuJqd8v4dKp02ibDIOIABHg==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: PSAPR03MB5464
X-Spam-Status: No, score=-0.2 required=5.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE autolearn=unavailable
        autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From 612bdaa44a8bed09cf8da15df0ad98c018fb5ae4 Mon Sep 17 00:00:00 2001
From: Lei Yin <yinlei2@lenovo.com>
Date: Thu, 6 Apr 2023 23:39:11 +0800
Subject: [PATCH] nvme: fix double blk_mq_complete_request for timeout reque=
st
 with low probability

When nvme_cancel_tagset traverses all tagsets and executes
nvme_cancel_request, this request may be executing blk_mq_free_request
that is called by nvme_rdma_complete_timed_out/nvme_tcp_complete_timed_out.
When blk_mq_free_request executes to WRITE_ONCE(rq->state, MQ_RQ_IDLE) and
__blk_mq_free_request(rq), it will cause double blk_mq_complete_request for
this request, and it will cause a null pointer error in the second
execution of this function because rq->mq_hctx has set to NULL in first
execution.

Signed-off-by: Lei Yin <yinlei2@lenovo.com>
---
 drivers/nvme/host/core.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 53ef028596c6..c1cc384f4f3e 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -450,8 +450,8 @@ bool nvme_cancel_request(struct request *req, void *dat=
a)
 	dev_dbg_ratelimited(((struct nvme_ctrl *) data)->device,
 				"Cancelling I/O %d", req->tag);
=20
-	/* don't abort one completed request */
-	if (blk_mq_request_completed(req))
+	/* don't abort one completed or idle request */
+	if (blk_mq_rq_state(req) !=3D MQ_RQ_IN_FLIGHT)
 		return true;
=20
 	nvme_req(req)->status =3D NVME_SC_HOST_ABORTED_CMD;
--=20
2.39.1