Commit 9f9cafc1 authored Jun 20, 2018 by Jianchao Wang Committed by Christoph Hellwig Jun 21, 2018

nvme-pci: move nvme_kill_queues to nvme_remove_dead_ctrl



There is race between nvme_remove and nvme_reset_work that can
lead to io hang.

nvme_remove                    nvme_reset_work
                               -> nvme_remove_dead_ctrl
                                 -> nvme_dev_disable
                                   -> quiesce request_queue
                                 -> queue remove_work
-> cancel_work_sync reset_work
-> nvme_remove_namespaces
  -> splice ctrl->namespaces
                               nvme_remove_dead_ctrl_work
                               -> nvme_kill_queues
  -> nvme_ns_remove               do nothing
    -> blk_cleanup_queue
      -> blk_freeze_queue

Finally, the request_queue is quiesced state when wait freeze,
we will get io hang here. To fix it, move the nvme_kill_queues
from nvme_remove_dead_ctrl_work to nvme_remove_dead_ctrl.

Suggested-by: Keith Busch <keith.busch@linux.intel.com>
Signed-off-by: Jianchao Wang <jianchao.w.wang@oracle.com>
Reviewed-by: Keith Busch <keith.busch@intel.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>

parent 02d62a8b

drivers/nvme/host/pci.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -2289,6 +2289,7 @@ static void nvme_remove_dead_ctrl(struct nvme_dev *dev, int status)

		nvme_get_ctrl(&dev->ctrl);
		nvme_dev_disable(dev, false);
		nvme_kill_queues(&dev->ctrl);
		if (!queue_work(nvme_wq, &dev->remove_work))
		nvme_put_ctrl(&dev->ctrl);
		}
		@@ -2405,7 +2406,6 @@ static void nvme_remove_dead_ctrl_work(struct work_struct *work)
		struct nvme_dev *dev = container_of(work, struct nvme_dev, remove_work);
		struct pci_dev *pdev = to_pci_dev(dev->dev);

		nvme_kill_queues(&dev->ctrl);
		if (pci_get_drvdata(pdev))
		device_release_driver(&pdev->dev);
		nvme_put_ctrl(&dev->ctrl);