From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753437AbbHEUo1 (ORCPT ); Wed, 5 Aug 2015 16:44:27 -0400 Received: from mx1.redhat.com ([209.132.183.28]:42054 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752026AbbHEUo0 (ORCPT ); Wed, 5 Aug 2015 16:44:26 -0400 From: Jeff Moyer To: Jens Axboe Cc: Ming Lei , Sam Bradshaw , Asai Thambi SP , linux-kernel@vger.kernel.org, dmilburn@redhat.com Subject: Re: [patch|rfc] mtip32x: fix regression introduced by blk-mq per-hctx flush References: <55B8E6D6.7090809@kernel.dk> X-PGP-KeyID: 1F78E1B4 X-PGP-CertKey: F6FE 280D 8293 F72C 65FD 5A58 1FF8 A7CA 1F78 E1B4 X-PCLoadLetter: What the f**k does that mean? Date: Wed, 05 Aug 2015 16:44:24 -0400 In-Reply-To: <55B8E6D6.7090809@kernel.dk> (Jens Axboe's message of "Wed, 29 Jul 2015 08:44:38 -0600") Message-ID: User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/24.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Jens Axboe writes: > On 07/29/2015 08:22 AM, Jeff Moyer wrote: >> Hi, >> >> After commit f70ced091707 (blk-mq: support per-distpatch_queue flush >> machinery), the mtip32xx driver may oops upon module load due to walking >> off the end of an array in mtip_init_cmd. On initialization of the >> flush_rq, init_request is called with request_index >= the maximum queue >> depth the driver supports. For mtip32xx, this value is used to index >> into an array. What this means is that the driver will walk off the end >> of the array, and either oops or cause random memory corruption. >> >> The problem is easily reproduced by doing modprobe/rmmod of the mtip32xx >> driver in a loop. I can typically reproduce the problem in about 30 >> seconds. >> >> Now, in the case of mtip32xx, it actually doesn't support flush/fua, so >> I think we can simply return without doing anything. In addition, no >> other mq-enabled driver does anything with the request_index passed into >> init_request(), so no other driver is affected. However, I'm not really >> sure what is expected of drivers. Ming, what did you envision drivers >> would do when initializing the flush requests? > > This is really a bug in the core, we should not have to work around > this in the driver. I'll take a look at this. Hi, Jens, Any update on this? -Jeff