[PATCH] nvme/pci: fix queue_rqs list splitting

[Keith Busch]

If command prep fails, current handling will orphan subsequent requests
in the list. Consider a simple example:

  rqlist = [ 1 -> 2 ]

When prep for request '1' fails, it will be appended to the
'requeue_list', leaving request '2' disconnected from the original
rqlist and no longer tracked. Meanwhile, rqlist is still pointing to the
failed 'req' and will attempt to submit the unprepped command.

Fix this by updating the rqlist accordingly.

Fixes: d62cbcf62f2f ("nvme: add support for mq_ops->queue_rqs()")
Signed-off-by: Keith Busch <kbusch at kernel.org>
---
Just IMO, the rq list manipulation looks a bit fragile for the lld. If
more drivers want to subscribe to the new .queue_rqs() interface, I have
another patch set ready for consideration with helper macros to make
this sort of error handling a little easier for re-use.

 drivers/nvme/host/pci.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index 50deb8b69c40..36398fee66c1 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -1007,20 +1007,33 @@ static void nvme_queue_rqs(struct request **rqlist)
 
 		if (!nvme_prep_rq_batch(nvmeq, req)) {
 			/* detach 'req' and add to remainder list */
+			struct request *next = rq_list_next(req);
+
 			if (prev)
-				prev->rq_next = req->rq_next;
+				prev->rq_next = next;
+			else
+				*rqlist = next;
+
 			rq_list_add(&requeue_list, req);
-		} else {
+
+			if (prev)
+				req = prev;
+			else
+				req = next;
+		}
+
+		if (req) {
 			prev = req;
+			req = rq_list_next(req);
 		}
 
-		req = rq_list_next(req);
 		if (!req || (prev && req->mq_hctx != prev->mq_hctx)) {
 			/* detach rest of list, and submit */
 			if (prev)
 				prev->rq_next = NULL;
 			nvme_submit_cmds(nvmeq, rqlist);
 			*rqlist = req;
+			prev = NULL;
 		}
 	} while (req);
 
-- 
2.25.4