All of lore.kernel.org
 help / color / mirror / Atom feed
From: Valentin Kleibel <valentin@vrvis.at>
To: stable@vger.kernel.org, Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jens Axboe <axboe@kernel.dk>, Justin Sanders <justin@coraid.com>,
	linux-block@vger.kernel.org
Subject: [PATCH] block: aoe: fix page fault in freedev()
Date: Thu, 10 Mar 2022 12:53:01 +0100	[thread overview]
Message-ID: <c274db07-9c7d-d857-33ad-4a762819bcdd@vrvis.at> (raw)

There is a bug in the aoe driver module where every forcible removal of 
an aoe device (eg. "rmmod aoe" with aoe devices available or "aoe-flush 
ex.x") leads to a page fault.
The code in freedev() calls blk_mq_free_tag_set() before running 
blk_cleanup_queue() which leads to this issue 
(drivers/block/aoe/aoedev.c L281ff).
This issue was fixed upstream in commit 6560ec9 (aoe: use 
blk_mq_alloc_disk and blk_cleanup_disk) with the introduction and use of 
the function blk_cleanup_disk().

This patch applies to kernels 5.4 and 5.10.

The function calls are reordered to match the behavior of 
blk_cleanup_disk() to mitigate this issue.

Fixes: 3582dd2 (aoe: convert aoeblk to blk-mq)
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215647
Signed-off-by: Valentin Kleibel <valentin@vrvis.at>
---
  drivers/block/aoe/aoedev.c | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
index e2ea2356da06..08c98ea724ea 100644
--- a/drivers/block/aoe/aoedev.c
+++ b/drivers/block/aoe/aoedev.c
@@ -277,9 +277,9 @@ freedev(struct aoedev *d)
         if (d->gd) {
                 aoedisk_rm_debugfs(d);
                 del_gendisk(d->gd);
+               blk_cleanup_queue(d->blkq);
                 put_disk(d->gd);
                 blk_mq_free_tag_set(&d->tag_set);
-               blk_cleanup_queue(d->blkq);
         }
         t = d->targets;
         e = t + d->ntargets;

             reply	other threads:[~2022-03-10 12:29 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-03-10 11:53 Valentin Kleibel [this message]
2022-03-10 12:03 ` [PATCH] block: aoe: fix page fault in freedev() Greg Kroah-Hartman
2022-03-10 12:24   ` Valentin Kleibel
2022-03-10 12:26     ` Greg Kroah-Hartman
2022-03-10 12:55       ` Valentin Kleibel
2022-03-14 11:12         ` Greg Kroah-Hartman
2022-03-31  9:58           ` [PATCH v2 0/2] " Valentin Kleibel
2022-03-31 10:00             ` [PATCH v2 1/2] block: add blk_alloc_disk and blk_cleanup_disk APIs Valentin Kleibel
2022-04-11 14:43               ` Greg Kroah-Hartman
2022-03-31 10:01             ` [PATCH v2 2/2] aoe: use blk_mq_alloc_disk and blk_cleanup_disk Valentin Kleibel

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=c274db07-9c7d-d857-33ad-4a762819bcdd@vrvis.at \
    --to=valentin@vrvis.at \
    --cc=axboe@kernel.dk \
    --cc=gregkh@linuxfoundation.org \
    --cc=justin@coraid.com \
    --cc=linux-block@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.