在 2025/08/01 19:44, Ming Lei 写道:
The freeing of the flush queue/request in blk_mq_exit_hctx() can race with tag iterators that may still be accessing it. To prevent a potential use-after-free, the deallocation should be deferred until after a grace period. With this way, we can replace the big tags->lock in tags iterator code path with srcu for solving the issue. This patch introduces an SRCU-based deferred freeing mechanism for the flush queue. The changes include: - Adding a `rcu_head` to `struct blk_flush_queue`. - Creating a new callback function, `blk_free_flush_queue_callback`, to handle the actual freeing. - Replacing the direct call to `blk_free_flush_queue()` in `blk_mq_exit_hctx()` with `call_srcu()`, using the `tags_srcu` instance to ensure synchronization with tag iterators. Signed-off-by: Ming Lei<ming.lei@xxxxxxxxxx> --- block/blk-mq.c | 11 ++++++++++- block/blk.h | 1 + 2 files changed, 11 insertions(+), 1 deletion(-)
LGTM Reviewed-by: Yu Kuai <yukuai3@xxxxxxxxxx>
