The release work resets the FETCH round without ub->mutex, while START_DEV checks it under ub->mutex: START_DEV (ub->mutex) release work all queues ready? yes ublksrv_tgid matches? yes ublk_reset_ch_dev(): io->cmd = NULL, nr_queue_ready = 0 go live: a request then reaches ublk_queue_cmd() with a NULL io->cmd Do the reset under ub->mutex. Then START_DEV sees the round either ready or reset. The work already takes ub->mutex when there is a disk, after it has aborted the requests; nothing holding ub->mutex waits for it. Fixes: 728cbac5fe21 ("ublk: move device reset into ublk_ch_release()") Cc: stable@vger.kernel.org Tested-by: Josef Bacik Signed-off-by: Ming Lei --- drivers/block/ublk_drv.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c index 35202789cf98..b65b33c1996d 100644 --- a/drivers/block/ublk_drv.c +++ b/drivers/block/ublk_drv.c @@ -2556,8 +2556,10 @@ static void ublk_ch_release_work_fn(struct work_struct *work) * reset, so that a new server can fetch and start the device. */ disk = ublk_get_disk(ub); - if (!disk) + if (!disk) { + mutex_lock(&ub->mutex); goto reset; + } /* * All uring_cmd are done now, so abort any request outstanding to @@ -2589,7 +2591,7 @@ static void ublk_ch_release_work_fn(struct work_struct *work) /* double check after grabbing lock */ if (!ub->ub_disk) - goto unlock; + goto reset; /* * Transition the device to the nosrv state. What exactly this @@ -2615,12 +2617,14 @@ static void ublk_ch_release_work_fn(struct work_struct *work) WRITE_ONCE(ublk_get_queue(ub, i)->fail_io, true); } } -unlock: - mutex_unlock(&ub->mutex); - ublk_put_disk(disk); reset: - /* all uring_cmd has been done now, reset device & ubq */ + /* + * All uring_cmd has been done now, reset device & ubq. Under + * ub->mutex, so START_DEV sees the round either ready or reset. + */ ublk_reset_ch_dev(ub); + mutex_unlock(&ub->mutex); + ublk_put_disk(disk); clear_bit(UB_STATE_OPEN, &ub->state); /* put the reference grabbed in ublk_ch_release() */ -- 2.55.0