Commit be8a9bc6 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'dm-4.0-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull device mapper fix from Mike Snitzer:
 "Fix DM core device cleanup regression -- due to a latent race that was
  exposed by the bdi changes that were introduced during the 4.0 merge"

* tag 'dm-4.0-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm: fix add_disk() NULL pointer due to race with free_dev()
parents 0e536e25 63a4f065
...@@ -433,7 +433,6 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode) ...@@ -433,7 +433,6 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode)
dm_get(md); dm_get(md);
atomic_inc(&md->open_count); atomic_inc(&md->open_count);
out: out:
spin_unlock(&_minor_lock); spin_unlock(&_minor_lock);
...@@ -442,16 +441,20 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode) ...@@ -442,16 +441,20 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode)
static void dm_blk_close(struct gendisk *disk, fmode_t mode) static void dm_blk_close(struct gendisk *disk, fmode_t mode)
{ {
struct mapped_device *md = disk->private_data; struct mapped_device *md;
spin_lock(&_minor_lock); spin_lock(&_minor_lock);
md = disk->private_data;
if (WARN_ON(!md))
goto out;
if (atomic_dec_and_test(&md->open_count) && if (atomic_dec_and_test(&md->open_count) &&
(test_bit(DMF_DEFERRED_REMOVE, &md->flags))) (test_bit(DMF_DEFERRED_REMOVE, &md->flags)))
queue_work(deferred_remove_workqueue, &deferred_remove_work); queue_work(deferred_remove_workqueue, &deferred_remove_work);
dm_put(md); dm_put(md);
out:
spin_unlock(&_minor_lock); spin_unlock(&_minor_lock);
} }
...@@ -2241,7 +2244,6 @@ static void free_dev(struct mapped_device *md) ...@@ -2241,7 +2244,6 @@ static void free_dev(struct mapped_device *md)
int minor = MINOR(disk_devt(md->disk)); int minor = MINOR(disk_devt(md->disk));
unlock_fs(md); unlock_fs(md);
bdput(md->bdev);
destroy_workqueue(md->wq); destroy_workqueue(md->wq);
if (md->kworker_task) if (md->kworker_task)
...@@ -2252,19 +2254,22 @@ static void free_dev(struct mapped_device *md) ...@@ -2252,19 +2254,22 @@ static void free_dev(struct mapped_device *md)
mempool_destroy(md->rq_pool); mempool_destroy(md->rq_pool);
if (md->bs) if (md->bs)
bioset_free(md->bs); bioset_free(md->bs);
blk_integrity_unregister(md->disk);
del_gendisk(md->disk);
cleanup_srcu_struct(&md->io_barrier); cleanup_srcu_struct(&md->io_barrier);
free_table_devices(&md->table_devices); free_table_devices(&md->table_devices);
free_minor(minor); dm_stats_cleanup(&md->stats);
spin_lock(&_minor_lock); spin_lock(&_minor_lock);
md->disk->private_data = NULL; md->disk->private_data = NULL;
spin_unlock(&_minor_lock); spin_unlock(&_minor_lock);
if (blk_get_integrity(md->disk))
blk_integrity_unregister(md->disk);
del_gendisk(md->disk);
put_disk(md->disk); put_disk(md->disk);
blk_cleanup_queue(md->queue); blk_cleanup_queue(md->queue);
dm_stats_cleanup(&md->stats); bdput(md->bdev);
free_minor(minor);
module_put(THIS_MODULE); module_put(THIS_MODULE);
kfree(md); kfree(md);
} }
...@@ -2642,8 +2647,9 @@ static void __dm_destroy(struct mapped_device *md, bool wait) ...@@ -2642,8 +2647,9 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
might_sleep(); might_sleep();
spin_lock(&_minor_lock);
map = dm_get_live_table(md, &srcu_idx); map = dm_get_live_table(md, &srcu_idx);
spin_lock(&_minor_lock);
idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md)))); idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md))));
set_bit(DMF_FREEING, &md->flags); set_bit(DMF_FREEING, &md->flags);
spin_unlock(&_minor_lock); spin_unlock(&_minor_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment