From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <stable-owner@vger.kernel.org>
Received: from mx0b-00082601.pphosted.com ([67.231.153.30]:29084 "EHLO
	mx0a-00082601.pphosted.com" rhost-flags-OK-OK-OK-FAIL)
	by vger.kernel.org with ESMTP id S1752081AbbFDOKv (ORCPT
	<rfc822;stable@vger.kernel.org>); Thu, 4 Jun 2015 10:10:51 -0400
Message-ID: <55705C5E.9080401@fb.com>
Date: Thu, 4 Jun 2015 08:10:38 -0600
From: Jens Axboe <axboe@fb.com>
MIME-Version: 1.0
To: Ming Lei <tom.leiming@gmail.com>,
	Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
CC: Stefan Seyfried <stefan.seyfried@googlemail.com>,
	NeilBrown <neilb@suse.de>, Christoph Hellwig <hch@lst.de>,
	"v4.0" <stable@vger.kernel.org>
Subject: Re: [PATCH] blk-mq: free hctx->ctxs in queue's release handler
References: <1433423645-18901-1-git-send-email-tom.leiming@gmail.com> <CACVXFVP+9w-aAn+ZprrpEy0XKqgiY5i+eQWWxDKiMKBPJGRKEA@mail.gmail.com>
In-Reply-To: <CACVXFVP+9w-aAn+ZprrpEy0XKqgiY5i+eQWWxDKiMKBPJGRKEA@mail.gmail.com>
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Transfer-Encoding: 7bit
Sender: stable-owner@vger.kernel.org
List-ID: <stable.vger.kernel.org>

On 06/04/2015 07:19 AM, Ming Lei wrote:
> On Thu, Jun 4, 2015 at 9:14 PM, Ming Lei <tom.leiming@gmail.com> wrote:
>> Now blk_cleanup_queue() can be called before calling
>> del_gendisk()[1], inside which hctx->ctxs is touched
>> from blk_mq_unregister_hctx(), but the variable has
>> been freed by blk_cleanup_queue() at that time.
>>
>> So this patch moves freeing of hctx->ctxs into queue's
>> release handler for fixing the oops reported by Stefan.
>>
>> Also ctx's kobject is embedded into each ctx pointed by
>> hctx->ctxs[], which shouldn't have been released so early.
>
> Hammm, the above line is wrong and should be removed, and
> hctx->ctxs[] just stores the pointer of ctx.
>
> Jens, if you need v1, please let me know.

Yeah, lets respin it please.

-- 
Jens Axboe