[PATCH v3 2/2] blk-mq: Fix a race condition in blk_mq_mark_tag_wait()

[Bart Van Assche]

Both add_wait_queue() and blk_mq_dispatch_wake() protect wait queue
manipulations with the wait queue lock. Hence also protect the
!list_empty(&wait->entry) test with the wait queue lock.

Signed-off-by: Bart Van Assche <bart.vanass...@wdc.com>
Cc: Christoph Hellwig <h...@lst.de>
Cc: Omar Sandoval <osan...@fb.com>
Cc: Hannes Reinecke <h...@suse.de>
Cc: Johannes Thumshirn <jthumsh...@suse.de>
---
 block/blk-mq.c | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/block/blk-mq.c b/block/blk-mq.c
index f27bcb6f6751..bbadbd5c8003 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1183,7 +1183,7 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx 
**hctx,
        struct blk_mq_hw_ctx *this_hctx = *hctx;
        struct sbq_wait_state *ws;
        wait_queue_entry_t *wait;
-       bool ret;
+       bool on_wait_list, ret;
 
        if (!(this_hctx->flags & BLK_MQ_F_TAG_SHARED)) {
                if (!test_bit(BLK_MQ_S_SCHED_RESTART, &this_hctx->state))
@@ -1204,13 +1204,15 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx 
**hctx,
        if (!list_empty_careful(&wait->entry))
                return false;
 
-       spin_lock(&this_hctx->lock);
-       if (!list_empty(&wait->entry)) {
-               spin_unlock(&this_hctx->lock);
+       ws = bt_wait_ptr(&this_hctx->tags->bitmap_tags, this_hctx);
+
+       spin_lock_irq(&ws->wait.lock);
+       on_wait_list = !list_empty(&wait->entry);
+       spin_unlock_irq(&ws->wait.lock);
+
+       if (on_wait_list)
                return false;
-       }
 
-       ws = bt_wait_ptr(&this_hctx->tags->bitmap_tags, this_hctx);
        add_wait_queue(&ws->wait, wait);
 
        /*
@@ -1219,10 +1221,8 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx 
**hctx,
         * queue.
         */
        ret = blk_mq_get_driver_tag(rq, hctx, false);
-       if (!ret) {
-               spin_unlock(&this_hctx->lock);
+       if (!ret)
                return false;
-       }
 
        /*
         * We got a tag, remove ourselves from the wait queue to ensure
@@ -1231,7 +1231,6 @@ static bool blk_mq_mark_tag_wait(struct blk_mq_hw_ctx 
**hctx,
        spin_lock_irq(&ws->wait.lock);
        list_del_init(&wait->entry);
        spin_unlock_irq(&ws->wait.lock);
-       spin_unlock(&this_hctx->lock);
 
        return true;
 }
-- 
2.15.1