@@ -108,8 +108,8 @@ void blk_queue_congestion_threshold(struct request_queue *q)
* @bdev: device
*
* Locates the passed device's request queue and returns the address of its
- * backing_dev_info. This function can only be called if @bdev is opened
- * and the return value is never NULL.
+ * backing_dev_info. This function can be called until the final iput()
+ * of the bdev inode.
*/
struct backing_dev_info *blk_get_backing_dev_info(struct block_device *bdev)
{
@@ -841,7 +841,11 @@ bool blk_poll(struct request_queue *q, blk_qc_t cookie);
static inline struct request_queue *bdev_get_queue(struct block_device *bdev)
{
- return bdev->bd_disk->queue; /* this is never NULL */
+ /*
+ * ->bd_queue is valid as long as there is a reference against
+ * the bdev inode.
+ */
+ return bdev->bd_queue;
}
/*
The ->bd_queue member of struct block_device was added in commit 87192a2a49c4 ("vfs: cache request_queue in struct block_device") in v3.3. However, blk_get_backing_dev_info() has been using bdev_get_queue() and grabbing the request_queue through the gendisk since before the git era. At final __blkdev_put() time ->bd_disk is cleared while ->bd_queue is not. The queue remains valid until the final put of the parent disk. The following crash signature results from blk_get_backing_dev_info() trying to lookup the queue through ->bd_disk after the final put of the block device. Simply switch bdev_get_queue() to use ->bd_queue directly which is guaranteed to still be valid since the request_queue is alive as long as the inode corresponding to the bdev has not been destroyed. BUG: unable to handle kernel NULL pointer dereference at 0000000000000568 IP: blk_get_backing_dev_info+0x10/0x20 [..] Call Trace: __inode_attach_wb+0x3a7/0x5d0 __filemap_fdatawrite_range+0xf8/0x100 filemap_write_and_wait+0x40/0x90 fsync_bdev+0x54/0x60 ? bdget_disk+0x30/0x40 invalidate_partition+0x24/0x50 del_gendisk+0xfa/0x230 Cc: Jan Kara <jack@suse.cz> Cc: Jens Axboe <axboe@fb.com> Cc: Jeff Moyer <jmoyer@redhat.com> Cc: Christoph Hellwig <hch@lst.de> Cc: Wei Fang <fangwei1@huawei.com> Cc: Rabin Vincent <rabinv@axis.com> Cc: Andi Kleen <ak@linux.intel.com> Signed-off-by: Dan Williams <dan.j.williams@intel.com> --- block/blk-core.c | 4 ++-- include/linux/blkdev.h | 6 +++++- 2 files changed, 7 insertions(+), 3 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-block" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html