Commit 35328115 authored by Laibin Qiu's avatar Laibin Qiu Committed by Zheng Zengkai
Browse files

block/wbt: fix negative inflight counter when remove scsi device 

hulk inclusion
category: bugfix
bugzilla: 185857 https://gitee.com/openeuler/kernel/issues/I4MMUW


CVE: NA

--------------------------------

Now that we disable wbt by set WBT_STATE_OFF_DEFAULT in
wbt_disable_default() when switch elevator to bfq. And when
we remove scsi device, wbt will be enabled by wbt_enable_default.
If it become false positive between wbt_wait() and wbt_track()
when submit write request.

The following is the scenario that triggered the problem.

T1                          T2                           T3
                            elevator_switch_mq
                            bfq_init_queue
                            wbt_disable_default <= Set
                            rwb->enable_state (OFF)
Submit_bio
blk_mq_make_request
rq_qos_throttle
<= rwb->enable_state (OFF)
                                                         scsi_remove_device
                                                         sd_remove
                                                         del_gendisk
                                                         blk_unregister_queue
                                                         elv_unregister_queue
                                                         wbt_enable_default
                                                         <= Set rwb->enable_state (ON)
q_qos_track
<= rwb->enable_state (ON)
^^^^^^ this request will mark WBT_TRACKED without inflight add and will
lead to drop rqw->inflight to -1 in wbt_done() which will trigger IO hung.

Fix this by move wbt_enable_default() from elv_unregister to
bfq_exit_queue(). Only re-enable wbt when bfq exit.
Fixes: 76a80408 ("blk-wbt: make sure throttle is enabled properly")
Signed-off-by: default avatarLaibin Qiu <qiulaibin@huawei.com>
Reviewed-by: default avatarJason Yan <yanaijie@huawei.com>
Signed-off-by: default avatarZheng Zengkai <zhengzengkai@huawei.com>
parent ceff49d9

block/bfq-iosched.c

+4 −0
Original line number Diff line number Diff line
@@ -6369,6 +6369,7 @@ static void bfq_exit_queue(struct elevator_queue *e) 
{

	struct bfq_data *bfqd = e->elevator_data;

	struct bfq_queue *bfqq, *n;

	struct request_queue *q = bfqd->queue;



	hrtimer_cancel(&bfqd->idle_slice_timer);
@@ -6392,6 +6393,9 @@ static void bfq_exit_queue(struct elevator_queue *e) 
#endif



	kfree(bfqd);



	/* Re-enable throttling in case elevator disabled it */

	wbt_enable_default(q);

}



static void bfq_init_root_group(struct bfq_group *root_group,

block/elevator.c

+0 −2
Original line number Diff line number Diff line
@@ -523,8 +523,6 @@ void elv_unregister_queue(struct request_queue *q) 
		kobject_del(&e->kobj);



		e->registered = 0;

		/* Re-enable throttling in case elevator disabled it */

		wbt_enable_default(q);

	}

}