From patchwork Fri Apr 26 14:50:52 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alex Elder X-Patchwork-Id: 2494031 Return-Path: X-Original-To: patchwork-ceph-devel@patchwork.kernel.org Delivered-To: patchwork-process-083081@patchwork2.kernel.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by patchwork2.kernel.org (Postfix) with ESMTP id 1C10FDFE86 for ; Fri, 26 Apr 2013 14:50:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755973Ab3DZOu5 (ORCPT ); Fri, 26 Apr 2013 10:50:57 -0400 Received: from mail-ia0-f174.google.com ([209.85.210.174]:58904 "EHLO mail-ia0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752938Ab3DZOu4 (ORCPT ); Fri, 26 Apr 2013 10:50:56 -0400 Received: by mail-ia0-f174.google.com with SMTP id h23so3692122iae.5 for ; Fri, 26 Apr 2013 07:50:55 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=x-received:message-id:date:from:user-agent:mime-version:to:subject :content-type:content-transfer-encoding:x-gm-message-state; bh=WEkuMjKvkfM4QDiszw78Unp6O4YdMb4v1Xel4FTxUjY=; b=BZvSFZU64RrFQ0QUfPF+4bsXbFMK9jYeT7HmpMxurYLe0hUXCiKnaNxccLJUnK8j/G oJwDe5g3Rw7+CbwWG6eQX/8pUSGViaPG1WYbQEUloWym3QXWjKoNtCIRELWHmL3po/PK mVAvEVIe6/q9tQ4sNFfhcZwpqLjo9MZB8FfHVnvCXrpT0a2FgUHS2yJdWFDqPa25/6Mt cotW7xnyVfQemLRP53pKEJt542VE3WyADHXE5nJQmITup1LV8QuRZGWtkG4LeLtx6EC2 BnxZZrd2BKAWeLQVgdJDprDhEfNipU6lJCCdxXeREVoqSWH5rrxFSxcoBBriRQHMBOY+ feAg== X-Received: by 10.50.11.138 with SMTP id q10mr2123107igb.5.1366987855546; Fri, 26 Apr 2013 07:50:55 -0700 (PDT) Received: from [172.22.22.4] (c-71-195-31-37.hsd1.mn.comcast.net. [71.195.31.37]) by mx.google.com with ESMTPSA id dy5sm3562344igc.1.2013.04.26.07.50.52 for (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Fri, 26 Apr 2013 07:50:53 -0700 (PDT) Message-ID: <517A944C.1090503@inktank.com> Date: Fri, 26 Apr 2013 09:50:52 -0500 From: Alex Elder User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130329 Thunderbird/17.0.5 MIME-Version: 1.0 To: ceph-devel@vger.kernel.org Subject: [PATCH] rbd: avoid dropping extra reference in rbd_free_disk() X-Gm-Message-State: ALoCoQnJIX3ems7OOzavXWYyPfvDbarGqnBmySkFyCljhNfDzHQ2Zr3eEJH7FM7eXgsl4r0dhOdO Sender: ceph-devel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: ceph-devel@vger.kernel.org I found during some failure injection testing that the call to rbd_free_disk() in the error path of rbd_dev_probe_finish() was dropping an extra reference to the disk queue. The problem occurred when put_disk tried to drop a reference to the disk's queue. A call to blk_cleanup_queue() just prior to that will have also dropped a reference to the queue. The problem is that the reference dropped by put_disk() is assumed to have been taken by add_disk(). Our code has error paths that can occur after the disk and its queue are initialized, but before the call to add_disk(), and in those paths we won't have that extra reference. The fix is easy though. In rbd_free_disk() we're already checking the disk's GENHD_FL_UP flag. That flag is an indication that add_disk() has been called, so just call blk_cleanup_queue() conditional on that flag being set. This resolves: http://tracker.ceph.com/issues/4800 Signed-off-by: Alex Elder Reviewed-by: Josh Durgin --- drivers/block/rbd.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c index dcd8e58..9e38967 100644 --- a/drivers/block/rbd.c +++ b/drivers/block/rbd.c @@ -2844,10 +2844,12 @@ static void rbd_free_disk(struct rbd_device *rbd_dev) if (!disk) return; - if (disk->flags & GENHD_FL_UP) + rbd_dev->disk = NULL; + if (disk->flags & GENHD_FL_UP) { del_gendisk(disk); - if (disk->queue) - blk_cleanup_queue(disk->queue); + if (disk->queue) + blk_cleanup_queue(disk->queue); + } put_disk(disk); }