From: Ben Hutchings <ben@decadent.org.uk>
To: Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>,
Jens Axboe <axboe@kernel.dk>
Cc: Jiri Kosina <jkosina@suse.cz>,
Andrew Morton <akpm@linux-foundation.org>,
Tejun Heo <tj@kernel.org>,
linux-kernel@vger.kernel.org, Vivek Goyal <vgoyal@redhat.com>,
Stanislaw Gruszka <sgruszka@redhat.com>
Subject: Re: [PATCH v3 3/6] floppy: avoid leaking extra reference to queue on do_floppy_init error handling
Date: Tue, 14 Aug 2012 04:20:39 +0100 [thread overview]
Message-ID: <1344914439.824.178.camel@deadeye.wl.decadent.org.uk> (raw)
In-Reply-To: <1344881787-6422-4-git-send-email-herton.krzesinski@canonical.com>
[-- Attachment #1: Type: text/plain, Size: 3865 bytes --]
On Mon, 2012-08-13 at 15:16 -0300, Herton Ronaldo Krzesinski wrote:
> After commit 3f9a5aa ("floppy: Cleanup disk->queue before caling
> put_disk() if add_disk() was never called"), if something fails in the
> add_disk loop, we unconditionally set disks[dr]->queue to NULL. But
> that's wrong, since we may have succesfully done an add_disk on some of
> the drives previously in the loop, and in this case we would end up with
> an extra reference to the disks[dr]->queue.
>
> Add a new global array to mark "registered" disks, and use that to check
> if we did an add_disk on one of the disks already. Using an array to
> track added disks also will help to simplify/cleanup code later, as
> suggested by Vivek Goyal.
[...]
It's totally ridiculous that a driver should have to do this. Any
registered disk should have the GENHD_FL_UP flag set... so why can't
genhd check it? It doesn't look like floppy is the only driver affected
by this problem, either. So I suggest the following general fix
(untested):
---
Subject: genhd: Make put_disk() safe for disks that have not been registered
Since commit 9f53d2f ('block: fix __blkdev_get and add_disk race
condition'), add_disk() adds a reference to disk->queue, which is then
dropped by disk_release(). But if a disk is destroyed without being
registered through add_disk() (or if add_disk() fails at the first
hurdle) then we have a reference imbalance.
Use the GENHD_FL_UP flag to tell whether this extra reference has been
added. Remove the incomplete workaround from the floppy driver.
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Cc: stable@vger.kernel.org
---
block/genhd.c | 6 +++---
drivers/block/floppy.c | 16 +---------------
2 files changed, 4 insertions(+), 18 deletions(-)
diff --git a/block/genhd.c b/block/genhd.c
index cac7366..6201212 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -587,8 +587,6 @@ void add_disk(struct gendisk *disk)
WARN_ON(disk->minors && !(disk->major || disk->first_minor));
WARN_ON(!disk->minors && !(disk->flags & GENHD_FL_EXT_DEVT));
- disk->flags |= GENHD_FL_UP;
-
retval = blk_alloc_devt(&disk->part0, &devt);
if (retval) {
WARN_ON(1);
@@ -596,6 +594,8 @@ void add_disk(struct gendisk *disk)
}
disk_to_dev(disk)->devt = devt;
+ disk->flags |= GENHD_FL_UP;
+
/* ->major and ->first_minor aren't supposed to be
* dereferenced from here on, but set them just in case.
*/
@@ -1105,7 +1105,7 @@ static void disk_release(struct device *dev)
disk_replace_part_tbl(disk, NULL);
free_part_stats(&disk->part0);
free_part_info(&disk->part0);
- if (disk->queue)
+ if (disk->queue && disk->flags & GENHD_FL_UP)
blk_put_queue(disk->queue);
kfree(disk);
}
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index a7d6347..cf27922 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -4325,14 +4325,8 @@ out_unreg_blkdev:
out_put_disk:
while (dr--) {
del_timer_sync(&motor_off_timer[dr]);
- if (disks[dr]->queue) {
+ if (disks[dr]->queue)
blk_cleanup_queue(disks[dr]->queue);
- /*
- * put_disk() is not paired with add_disk() and
- * will put queue reference one extra time. fix it.
- */
- disks[dr]->queue = NULL;
- }
put_disk(disks[dr]);
}
return err;
@@ -4560,14 +4554,6 @@ static void __exit floppy_module_exit(void)
}
blk_cleanup_queue(disks[drive]->queue);
- /*
- * These disks have not called add_disk(). Don't put down
- * queue reference in put_disk().
- */
- if (!(allowed_drive_mask & (1 << drive)) ||
- fdc_state[FDC(drive)].version == FDC_NONE)
- disks[drive]->queue = NULL;
-
put_disk(disks[drive]);
}
--
Ben Hutchings
I say we take off; nuke the site from orbit. It's the only way to be sure.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 828 bytes --]
next prev parent reply other threads:[~2012-08-14 3:21 UTC|newest]
Thread overview: 22+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-13 18:16 Bug fixes/cleanups for floppy driver (v2) Herton Ronaldo Krzesinski
2012-08-13 18:16 ` [PATCH v3 1/6] floppy: don't call alloc_ordered_workqueue inside the alloc_disk loop Herton Ronaldo Krzesinski
2012-08-14 2:01 ` Ben Hutchings
2012-08-13 18:16 ` [PATCH v3 2/6] floppy: do put_disk on current dr if blk_init_queue fails Herton Ronaldo Krzesinski
2012-08-14 2:04 ` Ben Hutchings
2012-08-14 19:48 ` Vivek Goyal
2012-08-14 20:08 ` Herton Ronaldo Krzesinski
2012-08-13 18:16 ` [PATCH v3 3/6] floppy: avoid leaking extra reference to queue on do_floppy_init error handling Herton Ronaldo Krzesinski
2012-08-14 3:20 ` Ben Hutchings [this message]
2012-08-14 9:03 ` Stanislaw Gruszka
2012-08-14 14:26 ` Herton Ronaldo Krzesinski
2012-08-14 14:28 ` Ben Hutchings
2012-08-14 14:33 ` Herton Ronaldo Krzesinski
2012-08-14 20:00 ` Vivek Goyal
2012-08-13 18:16 ` [PATCH v3 4/6] floppy: properly handle failure on add_disk loop Herton Ronaldo Krzesinski
2012-08-14 3:31 ` Ben Hutchings
2012-08-14 14:43 ` Herton Ronaldo Krzesinski
2012-08-27 23:53 ` Herton Ronaldo Krzesinski
2012-08-13 18:16 ` [PATCH v3 5/6] floppy: use disk_registered for checking if a drive is present Herton Ronaldo Krzesinski
2012-08-14 3:36 ` Ben Hutchings
2012-08-13 18:16 ` [PATCH v3 6/6] floppy: remove dr, reuse drive on do_floppy_init Herton Ronaldo Krzesinski
2012-08-13 18:21 ` Bug fixes/cleanups for floppy driver (v2) Herton Ronaldo Krzesinski
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1344914439.824.178.camel@deadeye.wl.decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=axboe@kernel.dk \
--cc=herton.krzesinski@canonical.com \
--cc=jkosina@suse.cz \
--cc=linux-kernel@vger.kernel.org \
--cc=sgruszka@redhat.com \
--cc=tj@kernel.org \
--cc=vgoyal@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).