From: Paolo Valente Date: Tue, 25 Jun 2019 05:12:44 +0000 (+0200) Subject: block, bfq: fix rq_in_driver check in bfq_update_inject_limit X-Git-Tag: v5.2.3~248 X-Git-Url: https://www.infradead.org/git/?a=commitdiff_plain;h=265c3b864dae188fe7682a92b0d1e073e399239e;p=users%2Fdwmw2%2Flinux.git block, bfq: fix rq_in_driver check in bfq_update_inject_limit [ Upstream commit db599f9ed9bd31b018b6c48ad7c6b21d5b790ecf ] One of the cases where the parameters for injection may be updated is when there are no more in-flight I/O requests. The number of in-flight requests is stored in the field bfqd->rq_in_driver of the descriptor bfqd of the device. So, the controlled condition is bfqd->rq_in_driver == 0. Unfortunately, this is wrong because, the instruction that checks this condition is in the code path that handles the completion of a request, and, in particular, the instruction is executed before bfqd->rq_in_driver is decremented in such a code path. This commit fixes this issue by just replacing 0 with 1 in the comparison. Reported-by: Srivatsa S. Bhat (VMware) Tested-by: Srivatsa S. Bhat (VMware) Signed-off-by: Paolo Valente Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin --- diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index e5db3856b194c..404e776aa36d0 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -5398,8 +5398,14 @@ static void bfq_update_inject_limit(struct bfq_data *bfqd, * total service time, and there seem to be the right * conditions to do it, or we can lower the last base value * computed. + * + * NOTE: (bfqd->rq_in_driver == 1) means that there is no I/O + * request in flight, because this function is in the code + * path that handles the completion of a request of bfqq, and, + * in particular, this function is executed before + * bfqd->rq_in_driver is decremented in such a code path. */ - if ((bfqq->last_serv_time_ns == 0 && bfqd->rq_in_driver == 0) || + if ((bfqq->last_serv_time_ns == 0 && bfqd->rq_in_driver == 1) || tot_time_ns < bfqq->last_serv_time_ns) { bfqq->last_serv_time_ns = tot_time_ns; /*