nvme-tcp: kernel NULL pointer dereference, address: 0000000000000034

[Sagi Grimberg]

>> I just attempted with the below patch and it seems to work.
>> The only change I did was to pass to blk_poll the cookie as well,
>> from bio_poll that is bi_cookie, and from blk_rq_poll it is computed
>> from the hctx directly.
> 
> I think we can can really simplify this path a lot knowing that we are dealing
> with a live request from a polling queue. Then we can poll for requests without
> bios too.
> 
> ---
> diff --git a/block/blk-mq.c b/block/blk-mq.c
> index d60ef2f0fa50b..b64c7d491306b 100644
> --- a/block/blk-mq.c
> +++ b/block/blk-mq.c
> @@ -1323,8 +1323,6 @@ bool blk_rq_is_poll(struct request *rq)
>   		return false;
>   	if (rq->mq_hctx->type != HCTX_TYPE_POLL)
>   		return false;
> -	if (WARN_ON_ONCE(!rq->bio))
> -		return false;
>   	return true;
>   }
>   EXPORT_SYMBOL_GPL(blk_rq_is_poll);
> @@ -1332,7 +1330,7 @@ EXPORT_SYMBOL_GPL(blk_rq_is_poll);
>   static void blk_rq_poll_completion(struct request *rq, struct completion *wait)
>   {
>   	do {
> -		bio_poll(rq->bio, NULL, 0);
> +		blk_mq_poll(rq->q, blk_rq_to_qc(rq), NULL, 0);
>   		cond_resched();
>   	} while (!completion_done(wait));
>   }
> --

Much simpler! Like