blk-mq: call blk_mq_start_request from ->queue_rq

When we call blk_mq_start_request from the core blk-mq code before calling into
->queue_rq there is a racy window where the timeout handler can hit before we've
fully set up the driver specific part of the command.

Move the call to blk_mq_start_request into the driver so the driver can start
the request only once it is fully set up.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>

3 files changed, 6 insertions, 0 deletions

diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 0e2084f37c67..4042440a0470 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -3783,6 +3783,8 @@ static int mtip_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *rq,
         if (unlikely(mtip_check_unal_depth(hctx, rq)))
                 return BLK_MQ_RQ_QUEUE_BUSY;
 
+        blk_mq_start_request(rq);
+
         ret = mtip_submit_request(hctx, rq);
         if (likely(!ret))
                 return BLK_MQ_RQ_QUEUE_OK;
diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index c5b7315c2c13..332ce20d45da 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c
@@ -321,6 +321,8 @@ static int null_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *rq,
         cmd->rq = rq;
         cmd->nq = hctx->driver_data;
 
+        blk_mq_start_request(rq);
+
         null_handle_cmd(cmd);
         return BLK_MQ_RQ_QUEUE_OK;
 }
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 13756e016797..83816bf6882f 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -205,6 +205,8 @@ static int virtio_queue_rq(struct blk_mq_hw_ctx *hctx, struct request *req,
                 }
         }
 
+        blk_mq_start_request(req);
+
         num = blk_rq_map_sg(hctx->queue, vbr->req, vbr->sg);
         if (num) {
                 if (rq_data_dir(vbr->req) == WRITE)