From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-pf0-f177.google.com ([209.85.192.177]:32773 "EHLO mail-pf0-f177.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755524AbcH2Uyn (ORCPT ); Mon, 29 Aug 2016 16:54:43 -0400 Date: Mon, 29 Aug 2016 16:54:39 -0400 From: Tejun Heo To: Vegard Nossum Cc: Rabin Vincent , Jens Axboe , Jan Kara , Al Viro , linux-block@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH] bdev: fix NULL pointer dereference in sync()/close() race Message-ID: <20160829205439.GG28713@mtj.duckdns.org> References: <20160827070728.12432-1-vegard.nossum@oracle.com> <20160827090328.GA9457@dator> <20160829195540.GE28713@mtj.duckdns.org> <5c8ff17a-27ba-0987-401d-9eeeb66b52f2@oracle.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii In-Reply-To: <5c8ff17a-27ba-0987-401d-9eeeb66b52f2@oracle.com> Sender: linux-block-owner@vger.kernel.org List-Id: linux-block@vger.kernel.org Hello, On Mon, Aug 29, 2016 at 10:49:57PM +0200, Vegard Nossum wrote: > That didn't work at all. I guess bd_acquire() would just do a bdgrab() > and not touch ->bd_holders, whereas blkdev_get() would increment Yeah, bdev has two different refs - one for bdev struct itself and the other for the actual accessors. > bd_holders and therefore prevent __blkdev_put() from freeing the block > device? Too confusing... I think you'll need to do the actual blkdev_get or one of its variants. Thanks. -- tejun