Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 777eb1bf authored by Hannes Reinecke's avatar Hannes Reinecke Committed by Jens Axboe
Browse files

block: Free queue resources at blk_release_queue() 



A kernel crash is observed when a mounted ext3/ext4 filesystem is
physically removed. The problem is that blk_cleanup_queue() frees up
some resources eg by calling elevator_exit(), which are not checked for
in normal operation. So we should rather move these calls to the
destructor function blk_release_queue() as at that point all remaining
references are gone. However, in doing so we have to ensure that any
externally supplied queue_lock is disconnected as the driver might free
up the lock after the call of blk_cleanup_queue(),

Signed-off-by: default avatarHannes Reinecke <hare@suse.de>
Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
parent a102a9ec

block/blk-core.c

+6 −7
Original line number Diff line number Diff line
@@ -348,9 +348,10 @@ void blk_put_queue(struct request_queue *q) 
EXPORT_SYMBOL(blk_put_queue);



/*

 * Note: If a driver supplied the queue lock, it should not zap that lock

 * unexpectedly as some queue cleanup components like elevator_exit() and

 * blk_throtl_exit() need queue lock.

 * Note: If a driver supplied the queue lock, it is disconnected

 * by this function. The actual state of the lock doesn't matter

 * here as the request_queue isn't accessible after this point

 * (QUEUE_FLAG_DEAD is set) and no other requests will be queued.

 */

void blk_cleanup_queue(struct request_queue *q)

{
@@ -367,10 +368,8 @@ void blk_cleanup_queue(struct request_queue *q) 
	queue_flag_set_unlocked(QUEUE_FLAG_DEAD, q);

	mutex_unlock(&q->sysfs_lock);



	if (q->elevator)

		elevator_exit(q->elevator);



	blk_throtl_exit(q);

	if (q->queue_lock != &q->__queue_lock)

		q->queue_lock = &q->__queue_lock;



	blk_put_queue(q);

}

block/blk-sysfs.c

+5 −0
Original line number Diff line number Diff line
@@ -479,6 +479,11 @@ static void blk_release_queue(struct kobject *kobj) 


	blk_sync_queue(q);



	if (q->elevator)

		elevator_exit(q->elevator);



	blk_throtl_exit(q);



	if (rl->rq_pool)

		mempool_destroy(rl->rq_pool);