On Wed, Jun 16, 2021 at 10:30:23AM +0800, Ming Lei wrote:

Not sure disk is valid, we only hold the disk when opening a bdev, but
the bdev can be closed during polling.

How?  On a block device the caller needs to hold the block device open
to read/write from it.  On a file systems the file systems needs to
be mounted, which also holds a bdev reference.

Also disk always holds one
reference on request queue, so if disk is valid, no need to grab queue's
refcnt in bio_poll().

But we need to avoid going into the lowlevel blk-mq polling code to not
reference the potentially freed hctxs or tags as correctly pointed by
yourself on the previous iteration.