[PATCH] zloop: remove the device ID after del_gendisk()

[Changyul Lee <lcy8047@gmail.com>]

zloop_ctl_remove() removes the device ID from zloop_index_idr before
del_gendisk() removes the "zloop<N>" disk from sysfs. An "add" request
issued in between can get the same ID, and its add_disk() fails:

  sysfs: cannot create duplicate filename '/devices/virtual/block/zloop0'
  ...
  zloop: add_disk failed (err=-17)

Remove the ID after del_gendisk() and before put_disk() frees the
device. Until then, an "add" requesting the same ID fails with -EEXIST,
and another "remove" fails with -EINVAL from the existing Zlo_deleting
check.

Fixes: eb0570c7df23 ("block: new zoned loop block device driver")
Signed-off-by: Changyul Lee <lcy8047@gmail.com>
---

Notes:
    Found with a static analysis tool we are developing.
    
    Reproduced in QEMU (x86_64) with two threads that each write
    "add id=0,..." and then "remove id=0" to /dev/zloop-control in a loop
    for 20 seconds, with the zone files on tmpfs. Without this patch,
    add_disk() failed 2126 times with the error above. With it, add_disk()
    never failed, and the requests that overlapped a deletion got -EEXIST
    ("add") or -EINVAL ("remove").

 drivers/block/zloop.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/block/zloop.c b/drivers/block/zloop.c
index 65634a39b0bf..8fb1f7fad286 100644
--- a/drivers/block/zloop.c
+++ b/drivers/block/zloop.c
@@ -1467,7 +1467,6 @@ static int zloop_ctl_remove(struct zloop_options *opts)
 	} else if (zlo->state == Zlo_deleting) {
 		ret = -EINVAL;
 	} else {
-		idr_remove(&zloop_index_idr, zlo->id);
 		WRITE_ONCE(zlo->state, Zlo_deleting);
 	}
 
@@ -1477,6 +1476,10 @@ static int zloop_ctl_remove(struct zloop_options *opts)
 
 	del_gendisk(zlo->disk);
 
+	mutex_lock(&zloop_ctl_mutex);
+	idr_remove(&zloop_index_idr, zlo->id);
+	mutex_unlock(&zloop_ctl_mutex);
+
 	if (zlo->discard_write_cache)
 		zloop_forget_cache(zlo);
 

base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.43.0