mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-11-01 17:08:10 +00:00
Code Issues Releases Wiki Activity
linux-stable/fs
History
Tejun Heo 523e1d399c block: make gendisk hold a reference to its queue 
The following command sequence triggers an oops.

# mount /dev/sdb1 /mnt
# echo 1 > /sys/class/scsi_device/0\:0\:1\:0/device/delete
# umount /mnt

 general protection fault: 0000 [#1] PREEMPT SMP
 CPU 2
 Modules linked in:

 Pid: 791, comm: umount Not tainted 3.1.0-rc3-work+ #8 Bochs Bochs
 RIP: 0010:[<ffffffff810d0879>]  [<ffffffff810d0879>] __lock_acquire+0x389/0x1d60
...
 Call Trace:
  [<ffffffff810d2845>] lock_acquire+0x95/0x140
  [<ffffffff81aed87b>] _raw_spin_lock+0x3b/0x50
  [<ffffffff811573bc>] bdi_lock_two+0x5c/0x70
  [<ffffffff811c2f6c>] bdev_inode_switch_bdi+0x4c/0xf0
  [<ffffffff811c3fcb>] __blkdev_put+0x11b/0x1d0
  [<ffffffff811c4010>] __blkdev_put+0x160/0x1d0
  [<ffffffff811c40df>] blkdev_put+0x5f/0x190
  [<ffffffff8118f18d>] kill_block_super+0x4d/0x80
  [<ffffffff8118f4a5>] deactivate_locked_super+0x45/0x70
  [<ffffffff8119003a>] deactivate_super+0x4a/0x70
  [<ffffffff811ac4ad>] mntput_no_expire+0xed/0x130
  [<ffffffff811acf2e>] sys_umount+0x7e/0x3a0
  [<ffffffff81aeeeab>] system_call_fastpath+0x16/0x1b

This is because bdev holds on to disk but disk doesn't pin the
associated queue.  If a SCSI device is removed while the device is
still open, the sdev puts the base reference to the queue on release.
When the bdev is finally released, the associated queue is already
gone along with the bdi and bdev_inode_switch_bdi() ends up
dereferencing already freed bdi.

Even if it were not for this bug, disk not holding onto the associated
queue is very unusual and error-prone.

Fix it by making add_disk() take an extra reference to its queue and
put it on disk_release() and ensuring that disk and its fops owner are
put in that order after all accesses to the disk and queue are
complete.

Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2011-10-19 14:31:07 +02:00
..
9p fs/9p: Use protocol-defined value for lock/getlock 'type' field. 2011-09-06 08:17:16 -05:00
adfs
affs fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
afs AFS: Fix silly characters in a comment 2011-07-20 20:48:03 -04:00
autofs4 autofs4: fix debug printk warning uncovered by cleanup 2011-08-08 12:02:43 -07:00
befs befs: Validate length of long symbolic links. 2011-08-17 13:31:24 -07:00
bfs bfs: remove unnecessary dentry_unhash on dir rename 2011-05-28 01:02:50 -04:00
btrfs Merge branch 'btrfs-3.0' of git://github.com/chrismason/linux 2011-10-13 18:20:40 +12:00
cachefiles kill useless checks for sb->s_op == NULL 2011-07-20 01:44:21 -04:00
ceph Merge branch 'for-linus' of git://ceph.newdream.net/git/ceph-client 2011-09-09 15:48:34 -07:00
cifs [CIFS] Fix first time message on mount, ntlmv2 upgrade delayed to 3.2 2011-10-07 20:17:56 -05:00
coda fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
configfs configfs: remove unnecessary dentry_unhash on rmdir, dir rename 2011-05-28 01:02:54 -04:00
cramfs cramfs: get_cramfs_inode() returns ERR_PTR() on failure 2011-07-17 23:22:02 -04:00
debugfs debugfs: move to new strtobool 2011-05-19 16:55:28 +09:30
devpts
dlm Merge branch 'for-3.1' of git://linux-nfs.org/~bfields/linux 2011-07-25 22:49:19 -07:00
ecryptfs Ecryptfs: Add mount option to check uid of device being mounted = expect uid 2011-08-09 23:29:01 -05:00
efs make d_splice_alias(ERR_PTR(err), dentry) = ERR_PTR(err) 2011-07-20 01:44:26 -04:00
exofs Merge branch 'for-linus' of git://git.open-osd.org/linux-open-osd 2011-08-06 22:56:03 -07:00
exportfs
ext2 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs-2.6 2011-08-01 13:48:31 -10:00
ext3 block: separate priority boosting from REQ_META 2011-08-23 14:50:29 +02:00
ext4 Merge branch 'for-linus' of git://git.kernel.dk/linux-block 2011-09-21 13:20:21 -07:00
fat Merge git://git.kernel.org/pub/scm/linux/kernel/git/hirofumi/fatfs-2.6 2011-08-18 14:16:13 -07:00
freevxfs treewide: fix a few typos in comments 2011-05-10 10:16:21 +02:00
fscache FS-Cache: Fix __fscache_uncache_all_inode_pages()'s outer loop 2011-07-21 10:59:16 -07:00
fuse fuse: fix memory leak 2011-09-12 11:47:10 -07:00
gfs2 block: separate priority boosting from REQ_META 2011-08-23 14:50:29 +02:00
hfs fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
hfsplus hfsplus: fix filesystem size checks 2011-09-15 09:03:17 -07:00
hostfs fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
hpfs fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
hppfs hppfs: missing include 2011-07-27 22:21:58 -04:00
hugetlbfs lockdep: Add helper function for dir vs file i_mutex annotation 2011-08-25 10:50:18 -07:00
isofs isofs: Remove global fs lock 2011-07-22 19:42:12 -04:00
jbd jbd: Use WRITE_SYNC in journal checkpoint. 2011-06-28 00:06:41 +02:00
jbd2 jbd2: remove jbd2_dev_to_name() from jbd2 tracepoints 2011-07-10 22:05:08 -04:00
jffs2 switch posix_acl_equiv_mode() to umode_t * 2011-08-01 02:10:06 -04:00
jfs Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/shaggy/jfs-2.6 2011-08-15 08:40:24 -07:00
lockd Merge branch 'nfs-for-3.1' of git://git.linux-nfs.org/projects/trondmy/linux-nfs 2011-07-27 13:23:02 -07:00
logfs fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
minix minix_getattr(): don't bother with ->d_parent 2011-07-20 20:47:53 -04:00
ncpfs fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
nfs VFS: Fix the remaining automounter semantics regressions 2011-09-26 19:16:46 -07:00
nfs_common
nfsd Merge branch 'for-3.1' of git://linux-nfs.org/~bfields/linux 2011-07-25 22:49:19 -07:00
nilfs2 fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
nls
notify atomic: use <linux/atomic.h> 2011-07-26 16:49:47 -07:00
ntfs atomic: use <linux/atomic.h> 2011-07-26 16:49:47 -07:00
ocfs2 switch posix_acl_equiv_mode() to umode_t * 2011-08-01 02:10:06 -04:00
omfs omfs: fix (mode & S_IFDIR) abuse 2011-07-26 13:05:28 -04:00
openpromfs
partitions Merge branch 'for-linus' into for-3.1/core 2011-07-01 16:17:13 +02:00
proc teach /proc/$pid/numa_maps about transparent hugepages 2011-09-21 13:15:44 -07:00
pstore pstore: Allow the user to explicitly choose a backend 2011-07-22 16:14:39 -07:00
qnx4
quota VFS: Fix the remaining automounter semantics regressions 2011-09-26 19:16:46 -07:00
ramfs ramfs: fix memleak on no-mmu arch 2011-04-14 16:06:56 -07:00
reiserfs switch posix_acl_equiv_mode() to umode_t * 2011-08-01 02:10:06 -04:00
romfs romfs: fix romfs_get_unmapped_area() argument check 2011-06-27 18:00:12 -07:00
squashfs Merge git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-linus 2011-07-25 22:50:35 -07:00
sysfs ->permission() sanitizing: don't pass flags to ->permission() 2011-07-20 01:43:24 -04:00
sysv sysv: remove unnecessary dentry_unhash from rmdir, dir rename 2011-05-28 01:02:50 -04:00
ubifs UBIFS: not build debug messages with CONFIG_UBIFS_FS_DEBUG disabled 2011-08-19 18:58:58 +03:00
udf switch udf_ioctl() to inode_permission() 2011-07-20 01:43:07 -04:00
ufs make d_splice_alias(ERR_PTR(err), dentry) = ERR_PTR(err) 2011-07-20 01:44:26 -04:00
xfs xfs: revert to using a kthread for AIL pushing 2011-10-11 11:02:49 -05:00
aio.c
anon_inodes.c vfs: dont chain pipe/anon/socket on superblock s_inodes list 2011-07-26 12:57:09 -04:00
attr.c fs: move inode_dio_wait calls into ->setattr 2011-07-20 20:47:47 -04:00
bad_inode.c fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
binfmt_aout.c
binfmt_elf.c consolidate BINPRM_FLAGS_ENFORCE_NONDUMP handling 2011-07-20 01:43:10 -04:00
binfmt_elf_fdpic.c consolidate BINPRM_FLAGS_ENFORCE_NONDUMP handling 2011-07-20 01:43:10 -04:00
binfmt_em86.c
binfmt_flat.c CRED: Fix load_flat_shared_library() to initialise bprm correctly 2011-05-03 10:10:51 +10:00
binfmt_misc.c consolidate BINPRM_FLAGS_ENFORCE_NONDUMP handling 2011-07-20 01:43:10 -04:00
binfmt_script.c
binfmt_som.c
bio-integrity.c
bio.c block: improve the bio_add_page() and bio_add_pc_page() descriptions 2011-05-28 14:44:46 +02:00
block_dev.c block: make gendisk hold a reference to its queue 2011-10-19 14:31:07 +02:00
buffer.c vfs: Fix data corruption after failed write in __block_write_begin() 2011-06-16 11:44:46 -04:00
char_dev.c
compat.c All Arch: remove linkage for sys_nfsservctl system call 2011-08-26 15:09:58 -07:00
compat_binfmt_elf.c
compat_ioctl.c compat_ioctl: add compat handler for PPPIOCGL2TPSTATS 2011-08-07 22:24:41 -07:00
dcache.c vfs: renumber DCACHE_xyz flags, remove some stale ones 2011-08-06 22:52:40 -07:00
dcookies.c oprofile, dcookies: Fix possible circular locking dependency 2011-05-31 16:33:35 +02:00
direct-io.c atomic: use <linux/atomic.h> 2011-07-26 16:49:47 -07:00
drop_caches.c vmscan: change shrinker API by passing shrink_control struct 2011-05-25 08:39:26 -07:00
eventfd.c
eventpoll.c atomic: use <linux/atomic.h> 2011-07-26 16:49:47 -07:00
exec.c move RLIMIT_NPROC check from set_user() to do_execve_common() 2011-08-11 11:24:42 -07:00
fcntl.c
fhandle.c fs/fhandle.c: add <linux/personality.h> for ia64 2011-04-14 16:06:56 -07:00
fifo.c
file.c vfs: avoid large kmalloc()s for the fdtable 2011-04-28 11:28:20 -07:00
file_table.c atomic: use <linux/atomic.h> 2011-07-26 16:49:47 -07:00
filesystems.c fs: synchronize_rcu when unregister_filesystem success not failure 2011-04-17 10:42:01 -07:00
fs-writeback.c don't busy retry the inode on failed grab_super_passive() 2011-07-31 22:52:08 +08:00
fs_struct.c
generic_acl.c switch posix_acl_equiv_mode() to umode_t * 2011-08-01 02:10:06 -04:00
inode.c lockdep: Add helper function for dir vs file i_mutex annotation 2011-08-25 10:50:18 -07:00
internal.h superblock: move pin_sb_for_writeback() to fs/super.c 2011-07-20 01:44:38 -04:00
ioctl.c
ioprio.c
Kconfig tmpfs: expand "help" to explain value of TMPFS_POSIX_ACL 2011-08-03 14:25:25 -10:00
Kconfig.binfmt
libfs.c fix IN_DELETE_SELF on overwriting rename() on ramfs et.al. 2011-07-22 19:42:11 -04:00
locks.c locks: rename lock-manager ops 2011-07-20 20:23:19 -04:00
Makefile nfsd: Remove deprecated nfsctl system call and related code. 2011-07-15 18:58:42 -04:00
mbcache.c vmscan: change shrinker API by passing shrink_control struct 2011-05-25 08:39:26 -07:00
mpage.c mm/fs: add hooks to support cleancache 2011-05-26 10:01:43 -06:00
namei.c vfs: remove LOOKUP_NO_AUTOMOUNT flag 2011-09-27 08:12:33 -07:00
namespace.c VFS: Fix the remaining automounter semantics regressions 2011-09-26 19:16:46 -07:00
no-block.c
open.c merge fchmod() and fchmodat() guts, kill ancient broken kludge 2011-07-26 15:07:43 -04:00
pipe.c vfs: dont chain pipe/anon/socket on superblock s_inodes list 2011-07-26 12:57:09 -04:00
pnode.c
pnode.h
posix_acl.c switch posix_acl_chmod() to umode_t 2011-08-01 02:10:32 -04:00
read_write.c fs: add missing unlock in default_llseek() 2011-07-26 12:57:09 -04:00
read_write.h
readdir.c
select.c
seq_file.c
signalfd.c
splice.c tmpfs: clone shmem_file_splice_read() 2011-07-25 20:57:11 -07:00
stack.c mm: a few small updates for radix-swap 2011-08-03 14:25:24 -10:00
stat.c vfs: remove LOOKUP_NO_AUTOMOUNT flag 2011-09-27 08:12:33 -07:00
statfs.c
super.c Merge branch 'for-3.1/core' of git://git.kernel.dk/linux-block 2011-07-25 10:33:36 -07:00
sync.c fs: push i_mutex and filemap_write_and_wait down into ->fsync() handlers 2011-07-20 20:47:59 -04:00
timerfd.c timerfd: Fix wakeup of processes when timer is cancelled on clock change 2011-06-14 11:46:14 +02:00
utimes.c
xattr.c Cache xattr security drop check for write v2 2011-05-28 12:02:09 -04:00
xattr_acl.c