Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d09960b0 authored by Tahsin Erdogan's avatar Tahsin Erdogan Committed by Mike Snitzer
Browse files

dm: free io_barrier after blk_cleanup_queue call 



dm_old_request_fn() has paths that access md->io_barrier.  The party
destroying io_barrier should ensure that no future execution of
dm_old_request_fn() is possible.  Move io_barrier destruction to below
blk_cleanup_queue() to ensure this and avoid a NULL pointer crash during
request-based DM device shutdown.

Cc: stable@vger.kernel.org # 4.3+
Signed-off-by: default avatarTahsin Erdogan <tahsin@google.com>
Signed-off-by: default avatarMike Snitzer <snitzer@redhat.com>
parent b052b07c

drivers/md/dm.c

+2 −2
Original line number Original line Diff line number Diff line
@@ -1423,8 +1423,6 @@ static void cleanup_mapped_device(struct mapped_device *md) 
	if (md->bs)

	if (md->bs)

		bioset_free(md->bs);

		bioset_free(md->bs);





	cleanup_srcu_struct(&md->io_barrier);



	if (md->disk) {

	if (md->disk) {

		spin_lock(&_minor_lock);

		spin_lock(&_minor_lock);

		md->disk->private_data = NULL;

		md->disk->private_data = NULL;
@@ -1436,6 +1434,8 @@ static void cleanup_mapped_device(struct mapped_device *md) 
	if (md->queue)

	if (md->queue)

		blk_cleanup_queue(md->queue);

		blk_cleanup_queue(md->queue);





	cleanup_srcu_struct(&md->io_barrier);



	if (md->bdev) {

	if (md->bdev) {

		bdput(md->bdev);

		bdput(md->bdev);

		md->bdev = NULL;

		md->bdev = NULL;