Received-SPF: pass (google.com: domain of linux-kernel+bounces-196337-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Date: Fri, 31 May 2024 08:17:08 +0200
From: Christoph Hellwig <hch@lst.de>
To: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Friedrich Weber <f.weber@proxmox.com>, axboe@kernel.dk,
	ming.lei@redhat.com, hch@lst.de, bvanassche@acm.org,
	linux-block@vger.kernel.org, linux-kernel@vger.kernel.org,
	zhouchengming@bytedance.com
Subject: Re: [PATCH v4 4/4] blk-flush: reuse rq queuelist in flush state
 machine
Message-ID: <20240531061708.GB18075@lst.de>
References: <14b89dfb-505c-49f7-aebb-01c54451db40@proxmox.com> <984f1f77-288c-441a-a649-5f320249b576@linux.dev> <4d799672-378b-42b1-896b-38df2c5e9c84@proxmox.com> <0783d367-4608-4b16-9b88-6eaf5d5706eb@linux.dev> <8b1400e6-b35e-486b-8ea0-de76270267c0@linux.dev> <87f495c2-7504-4d22-b355-608b13c456cd@linux.dev> <cb0fab18-ba27-420f-ace3-b099c74398c6@proxmox.com> <09be2bc6-d16a-4740-908a-f157dcd97ca8@linux.dev> <acc28f2c-0e72-409d-bb61-791ef62ddfd4@proxmox.com> <b73d3891-9a52-4f0c-b154-5a6d6117c697@linux.dev>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <b73d3891-9a52-4f0c-b154-5a6d6117c697@linux.dev>
User-Agent: Mutt/1.5.17 (2007-11-01)

On Wed, May 29, 2024 at 04:50:02PM +0800, Chengming Zhou wrote:
> Yes, because we use list_move_tail() in the flush sequences. Maybe we can
> just use list_add_tail() so we don't need the queuelist initialized. It
> should be ok since rq can't be on any list when PREFLUSH or POSTFLUSH,
> so there isn't any move actually.

Sounds good.

> But now I'm concerned that rq->queuelist maybe changed by driver after
> request end?

How could the driver change it?

> > Also, just out of interest: Can you estimate whether this issue is
> > specific to software RAID setups, or could similar NULL pointer
> > dereferences also happen in setups without software RAID?
> 
> I think it can also happen without software RAID.

Seems to be about batch allocation.  So you either need a plug in
the stacking device, or io_uring.  I guess people aren't using the
io_uring high performance options on devices with a write cache
all that much, as that should immediately reproduce the problem.