From nobody Fri Dec 19 17:18:59 2025 Received: from mail-pg1-f179.google.com (mail-pg1-f179.google.com [209.85.215.179]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 68DA434E760 for ; Thu, 4 Dec 2025 18:12:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.179 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764871963; cv=none; b=CohbQcZzlH+QmJWlujIy/wCUfBszmivTophYAXSbNGURon6zQDgBdleTaGn6CaQoclskUWf46lGdIsSPWLDUySdBL55jum0kg84mygTvS40APPCPbtXDCLKFkEe3+R6mZLzylI60S6Go94Aeibcty+/CE989F4iyhKohpk1I2G8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764871963; c=relaxed/simple; bh=IBFwytA32Wpg7N8PNqN5bNmay2fUL5irHNcwZXj37qk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=XB7KjhjH8SFDqYoeSl/Ba7jkbAq/ZB4NHScfmeDC2HyVcsFA+8X2fn6EvsGQLprItK122vWeAUhRmg4XLxaMHFT2umvXRdvcU1ltwqXFs7JoMDWbMLYTg3lwG7ATRUf1IPWCDLJ3CKp2j3vHecVe1FP/9ythHicW5JiYyJjxhK4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com; spf=fail smtp.mailfrom=purestorage.com; dkim=pass (2048-bit key) header.d=purestorage.com header.i=@purestorage.com header.b=F9gmQlpE; arc=none smtp.client-ip=209.85.215.179 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=purestorage.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=purestorage.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=purestorage.com header.i=@purestorage.com header.b="F9gmQlpE" Received: by mail-pg1-f179.google.com with SMTP id 41be03b00d2f7-b4755f37c3eso799443a12.3 for ; Thu, 04 Dec 2025 10:12:41 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=purestorage.com; s=google2022; t=1764871961; x=1765476761; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=wkTYaAp/Bwr2qvdUFL9MXQBSJP8TjVnrLBt94hBT5IA=; b=F9gmQlpElwMF3PNRgHMfddG8PfUmn4+z5kbYTDktqIfAQ4PUKmVqXEgcqLSMecU+Qy u3d7u26S6nOH+E495jYLTc7zvc71e/tKOcD5kux0/Td1jaQUfWkbv6696c8bjgiTxVNG rjqxLdVe0iweAUi9+EOEbvgh3MlMhA7tNhwpXlrWkTNcj4uSzTo6xNOZcyR5TTkt/rjV oEt4RvTKvzmUhhX1Hk1sAvPcRcCmgmGIoSNFkis1Ahi7AK3u3zUosX9P8M99+TVHC2T2 a21yj7xG2rC4hAyH1165zKw5nfUDNzyddUKEZTaL/zkcCJ25OoyaHR/sroJTez21HzFR zeEw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1764871961; x=1765476761; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=wkTYaAp/Bwr2qvdUFL9MXQBSJP8TjVnrLBt94hBT5IA=; b=Wx8ldqL2UOIEp+3Dq7qd7Ff6HX2tBLss09dRN4KTsvahpb9LgkJjpCirPXCfPYw+Ia cFovtYfrjDblgLBsA0+wxcvk2/Zy+vfD91b5VzZLZ8eWzOp+re2j5UJcDF9BOi99nFgP ApN/l0mwL6J2WQpGVjqrZqLwLbH9LAj+teiYOCKjOmBNzlJT9uJCflMyORoJ25hrzhY0 5B3tBrAncL7V6tZavK8qrTbbGhgvm06uCPlJRB3CYNv+ogMC2CQl3JXDA+Cx38yxT6UT 1jG0loXRK1BEn3cmWknOZgA9k/lwhP965OujHRqfVer4SgE6mt434KdYm0VTnT+zCUXA nl9w== X-Forwarded-Encrypted: i=1; AJvYcCUGBgPeqVxh0JsNb3wI2ORb3LbTKnnaXi2S5E1PM0Z6UPjoWvjN88QJQRnGgpsUZbhOPNSkEoxnXu+9xPI=@vger.kernel.org X-Gm-Message-State: AOJu0YxGq6t8Gko0bcWxOAq1B9s+witPYhAva5HH30ZAf6M7MDvquXAm 0vHA2bymiLb9oowFJRsWwNiWA2tadbotnSDb9D895/lnLn73rYXgDogKh+UOjtOG4L+SBEjiOZk 320Gr X-Gm-Gg: ASbGncuGEI7xdxjifIb4RWWhFt2NOmSZpftipRgD/lxYZZzyM36Khlqns5mJmkaO8IN 0mRNIk0Trx9BqsNw4ftIkRV7uJ1BGGhEHsK438Wbjdosk2XssLfV/GL5VzZw/YBk43aR0UsP8pe U6xMkdMU6SFNgORENxo5+2ACurtmcg7OTWBB+fjdO64T8r6KJWOvxDLwgVIZp/kCsipDK5msnsi kv4XVpsFqpDR6NfysD7tdi5XxbNtvRT9dtu3Hh4Frs+o8DxzMX8uUrmo2KTFaIcdjXJRo/zqDAz Wlb3Tk5GxUdtB3b3LlHt8bAck7oGDJGJcUGv3xYkQQWH8/954Pflhp+nBAGYSUx0mh1S0sr0Dq5 fgKbTXSlqhdB/ky18SI2WpnZqsF0oqrE0znDXVsw03wwZanl+QpKbZCSMrEGdmsrQCwh2FdCpE3 JGEhKXdhxAZ2t+1MDsgExbcOBZQUCYqjC31g== X-Google-Smtp-Source: AGHT+IFD8CHpgTKYp8RFzQjUFrV5P/g6cRtnJMlYeMKwqO9XKKGl7WN6jCHnhXjaV11aIP/wrSJptA== X-Received: by 2002:a05:7300:cc9c:b0:2a4:3644:4be3 with SMTP id 5a478bee46e88-2ab92ee527fmr4333722eec.27.1764871960337; Thu, 04 Dec 2025 10:12:40 -0800 (PST) Received: from apollo.purestorage.com ([208.88.152.253]) by smtp.googlemail.com with ESMTPSA id 5a478bee46e88-2aba8816ae9sm6998935eec.5.2025.12.04.10.12.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 04 Dec 2025 10:12:39 -0800 (PST) From: Mohamed Khalfella To: Chaitanya Kulkarni , Christoph Hellwig , Jens Axboe , Keith Busch , Sagi Grimberg Cc: Casey Chen , Yuanyuan Zhong , Hannes Reinecke , Ming Lei , Waiman Long , Hillf Danton , linux-nvme@lists.infradead.org, linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, Mohamed Khalfella Subject: [PATCH 1/1] block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock Date: Thu, 4 Dec 2025 10:11:53 -0800 Message-ID: <20251204181212.1484066-2-mkhalfella@purestorage.com> X-Mailer: git-send-email 2.51.2 In-Reply-To: <20251204181212.1484066-1-mkhalfella@purestorage.com> References: <20251204181212.1484066-1-mkhalfella@purestorage.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" blk_mq_{add,del}_queue_tag_set() functions add and remove queues from tagset, the functions make sure that tagset and queues are marked as shared when two or more queues are attached to the same tagset. Initially a tagset starts as unshared and when the number of added queues reaches two, blk_mq_add_queue_tag_set() marks it as shared along with all the queues attached to it. When the number of attached queues drops to 1 blk_mq_del_queue_tag_set() need to mark both the tagset and the remaining queues as unshared. Both functions need to freeze current queues in tagset before setting on unsetting BLK_MQ_F_TAG_QUEUE_SHARED flag. While doing so, both functions hold set->tag_list_lock mutex, which makes sense as we do not want queues to be added or deleted in the process. This used to work fine until commit 98d81f0df70c ("nvme: use blk_mq_[un]quiesce_tagset") made the nvme driver quiesce tagset instead of quiscing individual queues. blk_mq_quiesce_tagset() does the job and quiesce the queues in set->tag_list while holding set->tag_list_lock also. This results in deadlock between two threads with these stacktraces: __schedule+0x48e/0xed0 schedule+0x5a/0xc0 schedule_preempt_disabled+0x11/0x20 __mutex_lock.constprop.0+0x3cc/0x760 blk_mq_quiesce_tagset+0x26/0xd0 nvme_dev_disable_locked+0x77/0x280 [nvme] nvme_timeout+0x268/0x320 [nvme] blk_mq_handle_expired+0x5d/0x90 bt_iter+0x7e/0x90 blk_mq_queue_tag_busy_iter+0x2b2/0x590 ? __blk_mq_complete_request_remote+0x10/0x10 ? __blk_mq_complete_request_remote+0x10/0x10 blk_mq_timeout_work+0x15b/0x1a0 process_one_work+0x133/0x2f0 ? mod_delayed_work_on+0x90/0x90 worker_thread+0x2ec/0x400 ? mod_delayed_work_on+0x90/0x90 kthread+0xe2/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x2d/0x50 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork_asm+0x11/0x20 __schedule+0x48e/0xed0 schedule+0x5a/0xc0 blk_mq_freeze_queue_wait+0x62/0x90 ? destroy_sched_domains_rcu+0x30/0x30 blk_mq_exit_queue+0x151/0x180 disk_release+0xe3/0xf0 device_release+0x31/0x90 kobject_put+0x6d/0x180 nvme_scan_ns+0x858/0xc90 [nvme_core] ? nvme_scan_work+0x281/0x560 [nvme_core] nvme_scan_work+0x281/0x560 [nvme_core] process_one_work+0x133/0x2f0 ? mod_delayed_work_on+0x90/0x90 worker_thread+0x2ec/0x400 ? mod_delayed_work_on+0x90/0x90 kthread+0xe2/0x110 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork+0x2d/0x50 ? kthread_complete_and_exit+0x20/0x20 ret_from_fork_asm+0x11/0x20 The top stacktrace is showing nvme_timeout() called to handle nvme command timeout. timeout handler is trying to disable the controller and as a first step, it needs to blk_mq_quiesce_tagset() to tell blk-mq not to call queue callback handlers. The thread is stuck waiting for set->tag_list_lock as it tires to walk the queues in set->tag_list. The lock is held by the second thread in the bottom stack which is waiting for one of queues to be frozen. The queue usage counter will drop to zero after nvme_timeout() finishes, and this will not happen because the thread will wait for this mutex forever. Given that [un]quescing queue is an operation that does not need to sleep, update blk_mq_[un]quiesce_tagset() to use RCU instead of taking set->tag_list_lock. Also update blk_mq_{add,del}_queue_tag_set() to use RCU safe list operations. This should help avoid deadlock seen above. Signed-off-by: Mohamed Khalfella --- block/blk-mq.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index d626d32f6e57..ceb176ac154b 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -335,12 +335,12 @@ void blk_mq_quiesce_tagset(struct blk_mq_tag_set *set) { struct request_queue *q; =20 - mutex_lock(&set->tag_list_lock); - list_for_each_entry(q, &set->tag_list, tag_set_list) { + rcu_read_lock(); + list_for_each_entry_rcu(q, &set->tag_list, tag_set_list) { if (!blk_queue_skip_tagset_quiesce(q)) blk_mq_quiesce_queue_nowait(q); } - mutex_unlock(&set->tag_list_lock); + rcu_read_unlock(); =20 blk_mq_wait_quiesce_done(set); } @@ -350,12 +350,12 @@ void blk_mq_unquiesce_tagset(struct blk_mq_tag_set *s= et) { struct request_queue *q; =20 - mutex_lock(&set->tag_list_lock); - list_for_each_entry(q, &set->tag_list, tag_set_list) { + rcu_read_lock(); + list_for_each_entry_rcu(q, &set->tag_list, tag_set_list) { if (!blk_queue_skip_tagset_quiesce(q)) blk_mq_unquiesce_queue(q); } - mutex_unlock(&set->tag_list_lock); + rcu_read_unlock(); } EXPORT_SYMBOL_GPL(blk_mq_unquiesce_tagset); =20 @@ -4294,7 +4294,7 @@ static void blk_mq_del_queue_tag_set(struct request_q= ueue *q) struct blk_mq_tag_set *set =3D q->tag_set; =20 mutex_lock(&set->tag_list_lock); - list_del(&q->tag_set_list); + list_del_rcu(&q->tag_set_list); if (list_is_singular(&set->tag_list)) { /* just transitioned to unshared */ set->flags &=3D ~BLK_MQ_F_TAG_QUEUE_SHARED; @@ -4302,6 +4302,8 @@ static void blk_mq_del_queue_tag_set(struct request_q= ueue *q) blk_mq_update_tag_set_shared(set, false); } mutex_unlock(&set->tag_list_lock); + + synchronize_rcu(); INIT_LIST_HEAD(&q->tag_set_list); } =20 @@ -4321,7 +4323,7 @@ static void blk_mq_add_queue_tag_set(struct blk_mq_ta= g_set *set, } if (set->flags & BLK_MQ_F_TAG_QUEUE_SHARED) queue_set_hctx_shared(q, true); - list_add_tail(&q->tag_set_list, &set->tag_list); + list_add_tail_rcu(&q->tag_set_list, &set->tag_list); =20 mutex_unlock(&set->tag_list_lock); } --=20 2.51.2