mirror of
https://github.com/AuxXxilium/linux_dsm_epyc7002.git
synced 2024-12-23 11:55:03 +07:00
8d6996630c
We got a null pointer deference BUG_ON in blk_mq_rq_timed_out()
as following:
[ 108.825472] BUG: kernel NULL pointer dereference, address: 0000000000000040
[ 108.827059] PGD 0 P4D 0
[ 108.827313] Oops: 0000 [#1] SMP PTI
[ 108.827657] CPU: 6 PID: 198 Comm: kworker/6:1H Not tainted 5.3.0-rc8+ #431
[ 108.829503] Workqueue: kblockd blk_mq_timeout_work
[ 108.829913] RIP: 0010:blk_mq_check_expired+0x258/0x330
[ 108.838191] Call Trace:
[ 108.838406] bt_iter+0x74/0x80
[ 108.838665] blk_mq_queue_tag_busy_iter+0x204/0x450
[ 108.839074] ? __switch_to_asm+0x34/0x70
[ 108.839405] ? blk_mq_stop_hw_queue+0x40/0x40
[ 108.839823] ? blk_mq_stop_hw_queue+0x40/0x40
[ 108.840273] ? syscall_return_via_sysret+0xf/0x7f
[ 108.840732] blk_mq_timeout_work+0x74/0x200
[ 108.841151] process_one_work+0x297/0x680
[ 108.841550] worker_thread+0x29c/0x6f0
[ 108.841926] ? rescuer_thread+0x580/0x580
[ 108.842344] kthread+0x16a/0x1a0
[ 108.842666] ? kthread_flush_work+0x170/0x170
[ 108.843100] ret_from_fork+0x35/0x40
The bug is caused by the race between timeout handle and completion for
flush request.
When timeout handle function blk_mq_rq_timed_out() try to read
'req->q->mq_ops', the 'req' have completed and reinitiated by next
flush request, which would call blk_rq_init() to clear 'req' as 0.
After commit
|
||
---|---|---|
.. | ||
partitions | ||
badblocks.c | ||
bfq-cgroup.c | ||
bfq-iosched.c | ||
bfq-iosched.h | ||
bfq-wf2q.c | ||
bio-integrity.c | ||
bio.c | ||
blk-cgroup.c | ||
blk-core.c | ||
blk-exec.c | ||
blk-flush.c | ||
blk-integrity.c | ||
blk-ioc.c | ||
blk-iocost.c | ||
blk-iolatency.c | ||
blk-lib.c | ||
blk-map.c | ||
blk-merge.c | ||
blk-mq-cpumap.c | ||
blk-mq-debugfs-zoned.c | ||
blk-mq-debugfs.c | ||
blk-mq-debugfs.h | ||
blk-mq-pci.c | ||
blk-mq-rdma.c | ||
blk-mq-sched.c | ||
blk-mq-sched.h | ||
blk-mq-sysfs.c | ||
blk-mq-tag.c | ||
blk-mq-tag.h | ||
blk-mq-virtio.c | ||
blk-mq.c | ||
blk-mq.h | ||
blk-pm.c | ||
blk-pm.h | ||
blk-rq-qos.c | ||
blk-rq-qos.h | ||
blk-settings.c | ||
blk-softirq.c | ||
blk-stat.c | ||
blk-stat.h | ||
blk-sysfs.c | ||
blk-throttle.c | ||
blk-timeout.c | ||
blk-wbt.c | ||
blk-wbt.h | ||
blk-zoned.c | ||
blk.h | ||
bounce.c | ||
bsg-lib.c | ||
bsg.c | ||
cmdline-parser.c | ||
compat_ioctl.c | ||
elevator.c | ||
genhd.c | ||
ioctl.c | ||
ioprio.c | ||
Kconfig | ||
Kconfig.iosched | ||
kyber-iosched.c | ||
Makefile | ||
mq-deadline.c | ||
opal_proto.h | ||
partition-generic.c | ||
scsi_ioctl.c | ||
sed-opal.c | ||
t10-pi.c |