linux-block.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Christoph Hellwig <hch@lst.de>
To: Jens Axboe <axboe@kernel.dk>
Cc: Josef Bacik <josef@toxicpanda.com>,
	David Sterba <dsterba@suse.com>,
	Naohiro Aota <naohiro.aota@wdc.com>,
	linux-block@vger.kernel.org, linux-btrfs@vger.kernel.org,
	Ming Lei <ming.lei@redhat.com>
Subject: [PATCH 1/9] block: delay freeing the gendisk
Date: Thu, 22 Jul 2021 09:53:54 +0200	[thread overview]
Message-ID: <20210722075402.983367-2-hch@lst.de> (raw)
In-Reply-To: <20210722075402.983367-1-hch@lst.de>

blkdev_get_no_open acquires a reference to the block_device through
the block device inode and then tries to acquire a device model
reference to the gendisk.  But at this point the disk migh already
be freed (although the race is free).  Fix this by only freeing the
gendisk from the whole device bdevs ->free_inode callback as well.

Fixes: 22ae8ce8b892 ("block: simplify bdev/disk lookup in blkdev_get")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
---
 block/genhd.c  | 3 +--
 fs/block_dev.c | 2 ++
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/block/genhd.c b/block/genhd.c
index af4d2ab4a633..298ee78c1bda 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -1079,10 +1079,9 @@ static void disk_release(struct device *dev)
 	disk_release_events(disk);
 	kfree(disk->random);
 	xa_destroy(&disk->part_tbl);
-	bdput(disk->part0);
 	if (test_bit(GD_QUEUE_REF, &disk->state) && disk->queue)
 		blk_put_queue(disk->queue);
-	kfree(disk);
+	bdput(disk->part0);	/* frees the disk */
 }
 struct class block_class = {
 	.name		= "block",
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 0c424a0cadaa..9ef4f1fc2cb0 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -812,6 +812,8 @@ static void bdev_free_inode(struct inode *inode)
 	free_percpu(bdev->bd_stats);
 	kfree(bdev->bd_meta_info);
 
+	if (!bdev_is_partition(bdev))
+		kfree(bdev->bd_disk);
 	kmem_cache_free(bdev_cachep, BDEV_I(inode));
 }
 
-- 
2.30.2


  reply	other threads:[~2021-07-22  7:55 UTC|newest]

Thread overview: 22+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-07-22  7:53 fixes and cleanups for block_device refcounting v2 Christoph Hellwig
2021-07-22  7:53 ` Christoph Hellwig [this message]
2021-07-22  7:53 ` [PATCH 2/9] block: assert the locking state in delete_partition Christoph Hellwig
2021-07-22 18:38   ` Chaitanya Kulkarni
2021-07-22  7:53 ` [PATCH 3/9] block: unhash the whole device inode earlier Christoph Hellwig
2021-07-22  8:19   ` Ming Lei
2021-07-22 13:12     ` Christoph Hellwig
2021-07-22  7:53 ` [PATCH 4/9] block: allocate bd_meta_info later in add_partitions Christoph Hellwig
2021-07-22  8:32   ` Ming Lei
2021-07-22  7:53 ` [PATCH 5/9] block: change the refcounting for partitions Christoph Hellwig
2021-07-22  8:41   ` Ming Lei
2021-07-22 13:12     ` Christoph Hellwig
2021-07-22  7:53 ` [PATCH 6/9] btrfs: store a block_device in struct btrfs_ordered_extent Christoph Hellwig
2021-07-22 12:58   ` David Sterba
2021-07-22 13:04     ` Christoph Hellwig
2021-07-22  7:54 ` [PATCH 7/9] loop: don't grab a reference to the block device Christoph Hellwig
2021-07-22  8:57   ` Ming Lei
2021-07-22 18:40   ` Chaitanya Kulkarni
2021-07-22  7:54 ` [PATCH 8/9] block: remove bdgrab Christoph Hellwig
2021-07-22  7:54 ` [PATCH 9/9] block: remove bdput Christoph Hellwig
2021-07-22 18:40   ` Chaitanya Kulkarni
2021-07-28  1:39 ` fixes and cleanups for block_device refcounting v2 Jens Axboe

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210722075402.983367-2-hch@lst.de \
    --to=hch@lst.de \
    --cc=axboe@kernel.dk \
    --cc=dsterba@suse.com \
    --cc=josef@toxicpanda.com \
    --cc=linux-block@vger.kernel.org \
    --cc=linux-btrfs@vger.kernel.org \
    --cc=ming.lei@redhat.com \
    --cc=naohiro.aota@wdc.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).