nvme-tcp: kernel NULL pointer dereference, address: 0000000000000034

[Keith Busch]

On Tue, Mar 21, 2023 at 12:15:47PM +0200, Sagi Grimberg wrote:
> 
> > > > The admin tagset does not have a polled hctxs map to begin with,
> > > > so I'm unclear how any fabrics or admin requests end up polled...
> > > 
> > > Hmm, if no map_queues() callback is provided for the admin tag set,
> > > isn't the
> > > default mapping function used and this would add the poll hctxs map?
> > > Let me add
> > > a map_queues() callback and see what happens :)
> > 
> > admin_tagset.nr_maps = 1 (only the default map, no read, no poll)
> 
> Oddly, I don't see admin/fabrics requests being polled...
> 
> I just attempted with the below patch and it seems to work.
> The only change I did was to pass to blk_poll the cookie as well,
> from bio_poll that is bi_cookie, and from blk_rq_poll it is computed
> from the hctx directly.

I think we can can really simplify this path a lot knowing that we are dealing
with a live request from a polling queue. Then we can poll for requests without
bios too.

---
diff --git a/block/blk-mq.c b/block/blk-mq.c
index d60ef2f0fa50b..b64c7d491306b 100644
--- a/block/blk-mq.c
+++ b/block/blk-mq.c
@@ -1323,8 +1323,6 @@ bool blk_rq_is_poll(struct request *rq)
 		return false;
 	if (rq->mq_hctx->type != HCTX_TYPE_POLL)
 		return false;
-	if (WARN_ON_ONCE(!rq->bio))
-		return false;
 	return true;
 }
 EXPORT_SYMBOL_GPL(blk_rq_is_poll);
@@ -1332,7 +1330,7 @@ EXPORT_SYMBOL_GPL(blk_rq_is_poll);
 static void blk_rq_poll_completion(struct request *rq, struct completion *wait)
 {
 	do {
-		bio_poll(rq->bio, NULL, 0);
+		blk_mq_poll(rq->q, blk_rq_to_qc(rq), NULL, 0);
 		cond_resched();
 	} while (!completion_done(wait));
 }
--