[PATCH 0/2] blk-mq: stop waiting for an SRCU grace period when freeing a tag set

[PATCH 0/2] blk-mq: stop waiting for an SRCU grace period when freeing a tag set

[Qiliang Yuan]

blk_mq_free_tag_set() calls srcu_barrier() on the tag set's own
tags_srcu before cleaning it up. That costs a full SRCU grace period,
1-3 ms, on every tag set teardown. When the free happens under a lock,
the cost multiplies. ublk drops its last device reference under the
global ublk_ctl_mutex, which caps 16-thread deletion of 4000 devices at
19 s on 7.3-rc5.

The SRCU callbacks free only blk-mq-owned memory and never touch the
tag set, so patch 1 makes the SRCU instance global and drops the
per-set barrier and cleanup. Patch 2 removes the tag_set argument that
was added to blk_mq_free_rq_map() and blk_mq_free_tags() only to reach
the per-set instance.

With patch 1, 16-thread deletion of 4000 ublk devices takes 2.9 s and
serial DEL_DEV drops from 3.45 ms to 0.17 ms. Destroying 256 null_blk
devices from 16 threads goes from 5.15 s to 4.30 s.

Tested on 7.3-rc5 with ublk and null_blk create/destroy loops. A
KASAN + lockdep + DEBUG_OBJECTS_RCU_HEAD kernel ran a 10-minute stress
that raced device creation and destruction, I/O, scheduler and
nr_requests changes, and CPU hotplug against inflight, debugfs busy and
tags readers. It produced no reports.

Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
---
Qiliang Yuan (2):
      blk-mq: share one tags_srcu instance across all tag sets
      blk-mq: drop the tag_set argument from blk_mq_free_rq_map/tags

 block/blk-mq-tag.c     | 19 +++++++++++++------
 block/blk-mq.c         | 25 +++++++++----------------
 block/blk-mq.h         |  6 ++++--
 include/linux/blk-mq.h |  3 ---
 4 files changed, 26 insertions(+), 27 deletions(-)
---
base-commit: 551c722f40809618230001baccf219193e22fc5a
change-id: 20261001-bug-blk-mq-global-tags-srcu-811e8d958281

Best regards,
-- 
Qiliang Yuan <odys.yuan@gmail.com>

[PATCH 1/2] blk-mq: share one tags_srcu instance across all tag sets

[Qiliang Yuan]

Freed request pages and flush queues are handed to call_srcu() so that
concurrent tag iterators never see them disappear. Each tag set embeds
its own srcu_struct for this, which blk_mq_free_tag_set() has to drain
with srcu_barrier() before cleanup_srcu_struct(). The barrier waits for
a full SRCU grace period even when the callbacks are long done, adding
1-3 ms to every tag set teardown. Drivers that free tag sets under a
lock make it worse: ublk does it under the global ublk_ctl_mutex, so
deleting devices from many threads serializes on that grace period.

The callbacks free memory that only blk-mq owns. They touch neither
the tag set nor driver code, so they don't need a per-set domain.
Replace the per-set srcu_struct with a single global one. Freeing a tag
set no longer waits for a grace period, and each tag set no longer
allocates per-CPU SRCU state. The read side is unchanged. The only cost
is that a long-running iterator can now delay these frees for other tag
sets too, which only postpones freeing memory.

On 7.3-rc5 in a 16-vCPU VM, with 1 queue and depth 16 per ublk device,
median of 3 runs (5 for the 16-thread null_blk case):

                                       before     after
  ublk DEL_DEV p50, serial             3.45 ms    0.17 ms
  ublk delete 1000 devices, serial     19.5 s     14.9 s
  ublk delete 4000 devices, 16 thr     19.0 s     2.9 s
  null_blk destroy 500 devs, serial    9.97 s     9.25 s
  null_blk destroy 256 devs, 16 thr    5.15 s     4.30 s

Fixes: ad0d05dbddc1 ("blk-mq: Defer freeing of tags page_list to SRCU callback")
Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
---
 block/blk-mq-tag.c     | 17 ++++++++++++-----
 block/blk-mq.c         | 15 ++++-----------
 block/blk-mq.h         |  2 ++
 include/linux/blk-mq.h |  3 ---
 4 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 35deee5bbc739..6e01309226716 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -18,6 +18,13 @@
 #include "blk-mq.h"
 #include "blk-mq-sched.h"
 
+/*
+ * Protects tag iteration against the deferred freeing of tags->page_list and
+ * flush queues. The callbacks touch neither the tag set nor driver code, so
+ * one global instance is enough and freeing a tag set needn't wait for them.
+ */
+DEFINE_SRCU(blk_mq_tags_srcu);
+
 /*
  * Recalculate wakeup batch when tag is shared by hctx.
  */
@@ -443,7 +450,7 @@ void blk_mq_tagset_busy_iter(struct blk_mq_tag_set *tagset,
 	unsigned int flags = tagset->flags;
 	int i, nr_tags, srcu_idx;
 
-	srcu_idx = srcu_read_lock(&tagset->tags_srcu);
+	srcu_idx = srcu_read_lock(&blk_mq_tags_srcu);
 
 	nr_tags = blk_mq_is_shared_tags(flags) ? 1 : tagset->nr_hw_queues;
 
@@ -452,7 +459,7 @@ void blk_mq_tagset_busy_iter(struct blk_mq_tag_set *tagset,
 			__blk_mq_all_tag_iter(tagset->tags[i], fn, priv,
 					      BT_TAG_ITER_STARTED);
 	}
-	srcu_read_unlock(&tagset->tags_srcu, srcu_idx);
+	srcu_read_unlock(&blk_mq_tags_srcu, srcu_idx);
 }
 EXPORT_SYMBOL(blk_mq_tagset_busy_iter);
 
@@ -512,7 +519,7 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_tag_iter_fn *fn,
 	if (!percpu_ref_tryget(&q->q_usage_counter))
 		return;
 
-	srcu_idx = srcu_read_lock(&q->tag_set->tags_srcu);
+	srcu_idx = srcu_read_lock(&blk_mq_tags_srcu);
 	if (blk_mq_is_shared_tags(q->tag_set->flags)) {
 		struct blk_mq_tags *tags = q->tag_set->shared_tags;
 		struct sbitmap_queue *bresv = &tags->breserved_tags;
@@ -542,7 +549,7 @@ void blk_mq_queue_tag_busy_iter(struct request_queue *q, busy_tag_iter_fn *fn,
 			bt_for_each(hctx, q, btags, fn, priv, false);
 		}
 	}
-	srcu_read_unlock(&q->tag_set->tags_srcu, srcu_idx);
+	srcu_read_unlock(&blk_mq_tags_srcu, srcu_idx);
 	blk_queue_exit(q);
 }
 
@@ -618,7 +625,7 @@ void blk_mq_free_tags(struct blk_mq_tag_set *set, struct blk_mq_tags *tags)
 		return;
 	}
 
-	call_srcu(&set->tags_srcu, &tags->rcu_head, blk_mq_free_tags_callback);
+	call_srcu(&blk_mq_tags_srcu, &tags->rcu_head, blk_mq_free_tags_callback);
 }
 
 void blk_mq_tag_resize_shared_tags(struct blk_mq_tag_set *set, unsigned int size)
diff --git a/block/blk-mq.c b/block/blk-mq.c
index a26a11c73ee3e..f4ba1ac92a228 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -3683,9 +3683,9 @@ static bool blk_mq_hctx_has_requests(struct blk_mq_hw_ctx *hctx)
 	};
 	int srcu_idx;
 
-	srcu_idx = srcu_read_lock(&hctx->queue->tag_set->tags_srcu);
+	srcu_idx = srcu_read_lock(&blk_mq_tags_srcu);
 	blk_mq_all_tag_iter(tags, blk_mq_has_request, &data);
-	srcu_read_unlock(&hctx->queue->tag_set->tags_srcu, srcu_idx);
+	srcu_read_unlock(&blk_mq_tags_srcu, srcu_idx);
 
 	return data.has_rq;
 }
@@ -3957,7 +3957,7 @@ static void blk_mq_exit_hctx(struct request_queue *q,
 	if (set->ops->exit_hctx)
 		set->ops->exit_hctx(hctx, hctx_idx);
 
-	call_srcu(&set->tags_srcu, &hctx->fq->rcu_head,
+	call_srcu(&blk_mq_tags_srcu, &hctx->fq->rcu_head,
 			blk_free_flush_queue_callback);
 	hctx->fq = NULL;
 
@@ -4884,9 +4884,6 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)
 		if (ret)
 			goto out_free_srcu;
 	}
-	ret = init_srcu_struct(&set->tags_srcu);
-	if (ret)
-		goto out_cleanup_srcu;
 
 	init_rwsem(&set->update_nr_hwq_lock);
 
@@ -4895,7 +4892,7 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)
 				 sizeof(struct blk_mq_tags *), GFP_KERNEL,
 				 set->numa_node);
 	if (!set->tags)
-		goto out_cleanup_tags_srcu;
+		goto out_cleanup_srcu;
 
 	for (i = 0; i < set->nr_maps; i++) {
 		set->map[i].mq_map = kcalloc_node(nr_cpu_ids,
@@ -4924,8 +4921,6 @@ int blk_mq_alloc_tag_set(struct blk_mq_tag_set *set)
 	}
 	kfree(set->tags);
 	set->tags = NULL;
-out_cleanup_tags_srcu:
-	cleanup_srcu_struct(&set->tags_srcu);
 out_cleanup_srcu:
 	if (set->flags & BLK_MQ_F_BLOCKING)
 		cleanup_srcu_struct(set->srcu);
@@ -4972,8 +4967,6 @@ void blk_mq_free_tag_set(struct blk_mq_tag_set *set)
 	kfree(set->tags);
 	set->tags = NULL;
 
-	srcu_barrier(&set->tags_srcu);
-	cleanup_srcu_struct(&set->tags_srcu);
 	if (set->flags & BLK_MQ_F_BLOCKING) {
 		srcu_barrier(set->srcu);
 		cleanup_srcu_struct(set->srcu);
diff --git a/block/blk-mq.h b/block/blk-mq.h
index aa15d31aaae9b..e6b463da50712 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -178,6 +178,8 @@ struct blk_mq_tags *blk_mq_init_tags(unsigned int nr_tags,
 		unsigned int reserved_tags, unsigned int flags, int node);
 void blk_mq_free_tags(struct blk_mq_tag_set *set, struct blk_mq_tags *tags);
 
+extern struct srcu_struct blk_mq_tags_srcu;
+
 unsigned int blk_mq_get_tag(struct blk_mq_alloc_data *data);
 unsigned long blk_mq_get_tags(struct blk_mq_alloc_data *data, int nr_tags,
 		unsigned int *offset);
diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h
index af878597afb8c..5e130b282b42f 100644
--- a/include/linux/blk-mq.h
+++ b/include/linux/blk-mq.h
@@ -525,8 +525,6 @@ enum hctx_type {
  *		   request_queue.tag_set_list.
  * @srcu:	   Use as lock when type of the request queue is blocking
  *		   (BLK_MQ_F_BLOCKING).
- * @tags_srcu:	   SRCU used to defer freeing of tags page_list to prevent
- *		   use-after-free when iterating tags.
  * @update_nr_hwq_lock:
  * 		   Synchronize updating nr_hw_queues with add/del disk &
  * 		   switching elevator.
@@ -551,7 +549,6 @@ struct blk_mq_tag_set {
 	struct mutex		tag_list_lock;
 	struct list_head	tag_list;
 	struct srcu_struct	*srcu;
-	struct srcu_struct	tags_srcu;
 
 	struct rw_semaphore	update_nr_hwq_lock;
 };

-- 
2.43.0

[PATCH 2/2] blk-mq: drop the tag_set argument from blk_mq_free_rq_map/tags

[Qiliang Yuan]

Commit 9ad8e5af3279 ("blk-mq: Pass tag_set to blk_mq_free_rq_map/tags")
added the argument so that both helpers could reach the tag set's
tags_srcu. Now that the SRCU instance is global, nothing uses it.
Remove it.

No functional change.

Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>
---
 block/blk-mq-tag.c |  2 +-
 block/blk-mq.c     | 10 +++++-----
 block/blk-mq.h     |  4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/block/blk-mq-tag.c b/block/blk-mq-tag.c
index 6e01309226716..2b751bfa50e11 100644
--- a/block/blk-mq-tag.c
+++ b/block/blk-mq-tag.c
@@ -614,7 +614,7 @@ static void blk_mq_free_tags_callback(struct rcu_head *head)
 	kfree(tags);
 }
 
-void blk_mq_free_tags(struct blk_mq_tag_set *set, struct blk_mq_tags *tags)
+void blk_mq_free_tags(struct blk_mq_tags *tags)
 {
 	sbitmap_queue_free(&tags->bitmap_tags);
 	sbitmap_queue_free(&tags->breserved_tags);
diff --git a/block/blk-mq.c b/block/blk-mq.c
index f4ba1ac92a228..0c3c1481712a9 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -3496,14 +3496,14 @@ void blk_mq_free_rqs(struct blk_mq_tag_set *set, struct blk_mq_tags *tags,
 	 */
 }
 
-void blk_mq_free_rq_map(struct blk_mq_tag_set *set, struct blk_mq_tags *tags)
+void blk_mq_free_rq_map(struct blk_mq_tags *tags)
 {
 	kfree(tags->rqs);
 	tags->rqs = NULL;
 	kfree(tags->static_rqs);
 	tags->static_rqs = NULL;
 
-	blk_mq_free_tags(set, tags);
+	blk_mq_free_tags(tags);
 }
 
 static enum hctx_type hctx_idx_to_type(struct blk_mq_tag_set *set,
@@ -3565,7 +3565,7 @@ static struct blk_mq_tags *blk_mq_alloc_rq_map(struct blk_mq_tag_set *set,
 err_free_rqs:
 	kfree(tags->rqs);
 err_free_tags:
-	blk_mq_free_tags(set, tags);
+	blk_mq_free_tags(tags);
 	return NULL;
 }
 
@@ -4118,7 +4118,7 @@ struct blk_mq_tags *blk_mq_alloc_map_and_rqs(struct blk_mq_tag_set *set,
 
 	ret = blk_mq_alloc_rqs(set, tags, hctx_idx, depth);
 	if (ret) {
-		blk_mq_free_rq_map(set, tags);
+		blk_mq_free_rq_map(tags);
 		return NULL;
 	}
 
@@ -4146,7 +4146,7 @@ void blk_mq_free_map_and_rqs(struct blk_mq_tag_set *set,
 {
 	if (tags) {
 		blk_mq_free_rqs(set, tags, hctx_idx);
-		blk_mq_free_rq_map(set, tags);
+		blk_mq_free_rq_map(tags);
 	}
 }
 
diff --git a/block/blk-mq.h b/block/blk-mq.h
index e6b463da50712..1e64236d34d42 100644
--- a/block/blk-mq.h
+++ b/block/blk-mq.h
@@ -62,7 +62,7 @@ void blk_mq_put_rq_ref(struct request *rq);
  */
 void blk_mq_free_rqs(struct blk_mq_tag_set *set, struct blk_mq_tags *tags,
 		     unsigned int hctx_idx);
-void blk_mq_free_rq_map(struct blk_mq_tag_set *set, struct blk_mq_tags *tags);
+void blk_mq_free_rq_map(struct blk_mq_tags *tags);
 struct blk_mq_tags *blk_mq_alloc_map_and_rqs(struct blk_mq_tag_set *set,
 				unsigned int hctx_idx, unsigned int depth);
 void blk_mq_free_map_and_rqs(struct blk_mq_tag_set *set,
@@ -176,7 +176,7 @@ struct blk_mq_alloc_data {
 
 struct blk_mq_tags *blk_mq_init_tags(unsigned int nr_tags,
 		unsigned int reserved_tags, unsigned int flags, int node);
-void blk_mq_free_tags(struct blk_mq_tag_set *set, struct blk_mq_tags *tags);
+void blk_mq_free_tags(struct blk_mq_tags *tags);
 
 extern struct srcu_struct blk_mq_tags_srcu;
 

-- 
2.43.0

Re: [PATCH 0/2] blk-mq: stop waiting for an SRCU grace period when freeing a tag set

[Paul E. McKenney]

On Thu, Oct 01, 2026 at 05:17:49PM +0800, Qiliang Yuan wrote:
> blk_mq_free_tag_set() calls srcu_barrier() on the tag set's own
> tags_srcu before cleaning it up. That costs a full SRCU grace period,
> 1-3 ms, on every tag set teardown. When the free happens under a lock,
> the cost multiplies. ublk drops its last device reference under the
> global ublk_ctl_mutex, which caps 16-thread deletion of 4000 devices at
> 19 s on 7.3-rc5.
> 
> The SRCU callbacks free only blk-mq-owned memory and never touch the
> tag set, so patch 1 makes the SRCU instance global and drops the
> per-set barrier and cleanup. Patch 2 removes the tag_set argument that
> was added to blk_mq_free_rq_map() and blk_mq_free_tags() only to reach
> the per-set instance.
> 
> With patch 1, 16-thread deletion of 4000 ublk devices takes 2.9 s and
> serial DEL_DEV drops from 3.45 ms to 0.17 ms. Destroying 256 null_blk
> devices from 16 threads goes from 5.15 s to 4.30 s.
> 
> Tested on 7.3-rc5 with ublk and null_blk create/destroy loops. A
> KASAN + lockdep + DEBUG_OBJECTS_RCU_HEAD kernel ran a 10-minute stress
> that raced device creation and destruction, I/O, scheduler and
> nr_requests changes, and CPU hotplug against inflight, debugfs busy and
> tags readers. It produced no reports.
> 
> Signed-off-by: Qiliang Yuan <odys.yuan@gmail.com>

Looks plausible from an RCU viewpoint.

Acked-by: Paul E. McKenney <paulmck@kernel.org>

> ---
> Qiliang Yuan (2):
>       blk-mq: share one tags_srcu instance across all tag sets
>       blk-mq: drop the tag_set argument from blk_mq_free_rq_map/tags
> 
>  block/blk-mq-tag.c     | 19 +++++++++++++------
>  block/blk-mq.c         | 25 +++++++++----------------
>  block/blk-mq.h         |  6 ++++--
>  include/linux/blk-mq.h |  3 ---
>  4 files changed, 26 insertions(+), 27 deletions(-)
> ---
> base-commit: 551c722f40809618230001baccf219193e22fc5a
> change-id: 20261001-bug-blk-mq-global-tags-srcu-811e8d958281
> 
> Best regards,
> -- 
> Qiliang Yuan <odys.yuan@gmail.com>
> 

Re: [PATCH 0/2] blk-mq: stop waiting for an SRCU grace period when freeing a tag set

[Qiliang Yuan]

Hi Jens, Ming,

Gentle ping on this series. Paul acked it from the RCU side, and it
still needs a look from the block side.

Since I sent it, "ublk: drop the device reference outside
ublk_ctl_mutex in DEL_DEV" has been applied to for-7.4/block, so ublk
no longer frees tag sets under a global lock and the 19 s figure in
the cover letter is out of date. The SRCU grace period that every
blk_mq_free_tag_set() waits for is still there. With 4000 single-queue
ublk devices on 7.3-rc5 plus that commit, median of 3 runs:

                                 without      with this series
  DEL_DEV p50, serial             3.41ms           0.17ms
  deletion with 16 threads         4.17s            2.87s

Thanks,
Qiliang