Re: [RFC PATCH] blk-mq: Clean up references when freeing rqs

[John Garry]

Hi Ming,

On 10/12/2020 02:07, Ming Lei wrote:
> > Apart from this, my concern is that we come with for a solution, but it's a
> > complicated solution and may not be accepted as this issue is not seen as a
> > problem in practice.
> If that is the case, I'd suggest to consider the solution in the
> following link:
>
> https://lore.kernel.org/linux-block/20200820180335.3109216-1-ming.lei@xxxxxxxxxx/
>
> At least, the idea is simple, which can be extended to support allocate driver tags
> request pool dynamically.

As I see with your approach, we may still iterate a stale request, but 
it just has not been freed, so just no use-after-free BUG, right? Rather 
it is cached until all references dropped. It may be best solution.

So I'll try an experiment today to prove your concern about 
blk_mq_queue_tag_busy_iter(). Then look at possible solution which 
builds on patch in $subject, and compare.

Thanks,
John