在 2025/08/01 19:44, Ming Lei 写道:

The freeing of the flush queue/request in blk_mq_exit_hctx() can race with
tag iterators that may still be accessing it. To prevent a potential
use-after-free, the deallocation should be deferred until after a grace
period. With this way, we can replace the big tags->lock in tags iterator
code path with srcu for solving the issue.

This patch introduces an SRCU-based deferred freeing mechanism for the
flush queue.

The changes include:
- Adding a `rcu_head` to `struct blk_flush_queue`.
- Creating a new callback function, `blk_free_flush_queue_callback`,
   to handle the actual freeing.
- Replacing the direct call to `blk_free_flush_queue()` in
   `blk_mq_exit_hctx()` with `call_srcu()`, using the `tags_srcu`
   instance to ensure synchronization with tag iterators.

Signed-off-by: Ming Lei<redacted>
---
  block/blk-mq.c | 11 ++++++++++-
  block/blk.h    |  1 +
  2 files changed, 11 insertions(+), 1 deletion(-)

LGTM
Reviewed-by: Yu Kuai <redacted>