On 4/23/21 2:01 PM, Bart Van Assche wrote:

hctx->tags->rqs[] must be cleared before releasing a request tag because
otherwise clearing that pointer races with the following assignment in
blk_mq_get_driver_tag():

	rcu_assign_pointer(hctx->tags->rqs[rq->tag], rq);

Looks good to me. Applied, and added:

Fixes: 5ba3f5a6ca7e ("blk-mq: Fix races between iterating over requests and freeing requests")

which was missing.

-- 
Jens Axboe