On 2020-03-26 17:19, Dongli Zhang wrote:

I think the issue is because of line 2827, that is, the q->nr_hw_queues is
updated too earlier. It is still possible the init would fail later.

2809 static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set,
2810                                                 struct request_queue *q)
2811 {
2812         int i, j, end;
2813         struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx;
2814
2815         if (q->nr_hw_queues < set->nr_hw_queues) {
2816                 struct blk_mq_hw_ctx **new_hctxs;
2817
2818                 new_hctxs = kcalloc_node(set->nr_hw_queues,
2819                                        sizeof(*new_hctxs), GFP_KERNEL,
2820                                        set->numa_node);
2821                 if (!new_hctxs)
2822                         return;
2823                 if (hctxs)
2824                         memcpy(new_hctxs, hctxs, q->nr_hw_queues *
2825                                sizeof(*hctxs));
2826                 q->queue_hw_ctx = new_hctxs;
2827                 q->nr_hw_queues = set->nr_hw_queues;
2828                 kfree(hctxs);
2829                 hctxs = new_hctxs;
2830         }

Which kernel tree does this syzbot report refer to? Commit
d0930bb8f46b ("blk-mq: Fix a recently introduced regression in
blk_mq_realloc_hw_ctxs()") in Jens' tree removed line 2827 shown above.

Thanks,

Bart.