• Mike Snitzer's avatar
    dm: fix free_rq_clone() NULL pointer when requeueing unmapped request · aa6df8dd
    Mike Snitzer authored
    Commit 02233342 ("dm: optimize dm_mq_queue_rq to _not_ use kthread if
    using pure blk-mq") mistakenly removed free_rq_clone()'s clone->q check
    before testing clone->q->mq_ops.  It was an oversight to discontinue
    that check for 1 of the 2 use-cases for free_rq_clone():
    1) free_rq_clone() called when an unmapped original request is requeued
    2) free_rq_clone() called in the request-based IO completion path
    
    The clone->q check made sense for case #1 but not for #2.  However, we
    cannot just reinstate the check as it'd mask a serious bug in the IO
    completion case #2 -- no in-flight request should have an uninitialized
    request_queue (basic block layer refcounting _should_ ensure this).
    
    The NULL pointer seen for case #1 is detailed here:
    https://www.redhat.com/archives/dm-devel/2015-April/msg00160.html
    
    Fix this free_rq_clone() NULL pointer by simply checking if the
    mapped_device's type is DM_TYPE_MQ_REQUEST_BASED (clone's queue is
    blk-mq) rather than checking clone->q->mq_ops.  This avoids the need to
    dereference clone->q, but a WARN_ON_ONCE is added to let us know if an
    uninitialized clone request is being completed.
    Reported-by: default avatarBart Van Assche <bart.vanassche@sandisk.com>
    Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
    aa6df8dd
dm.c 84.1 KB