block: Free queue resources at blk_release_queue()

A kernel crash is observed when a mounted ext3/ext4 filesystem is
physically removed. The problem is that blk_cleanup_queue() frees up
some resources eg by calling elevator_exit(), which are not checked for
in normal operation. So we should rather move these calls to the
destructor function blk_release_queue() as at that point all remaining
references are gone. However, in doing so we have to ensure that any
externally supplied queue_lock is disconnected as the driver might free
up the lock after the call of blk_cleanup_queue(),

Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
This commit is contained in:
Hannes Reinecke 2011-09-28 08:07:01 -06:00 committed by Jens Axboe
parent a102a9ece5
commit 777eb1bf15
2 changed files with 11 additions and 7 deletions

View File

@ -348,9 +348,10 @@ void blk_put_queue(struct request_queue *q)
EXPORT_SYMBOL(blk_put_queue); EXPORT_SYMBOL(blk_put_queue);
/* /*
* Note: If a driver supplied the queue lock, it should not zap that lock * Note: If a driver supplied the queue lock, it is disconnected
* unexpectedly as some queue cleanup components like elevator_exit() and * by this function. The actual state of the lock doesn't matter
* blk_throtl_exit() need queue lock. * here as the request_queue isn't accessible after this point
* (QUEUE_FLAG_DEAD is set) and no other requests will be queued.
*/ */
void blk_cleanup_queue(struct request_queue *q) void blk_cleanup_queue(struct request_queue *q)
{ {
@ -367,10 +368,8 @@ void blk_cleanup_queue(struct request_queue *q)
queue_flag_set_unlocked(QUEUE_FLAG_DEAD, q); queue_flag_set_unlocked(QUEUE_FLAG_DEAD, q);
mutex_unlock(&q->sysfs_lock); mutex_unlock(&q->sysfs_lock);
if (q->elevator) if (q->queue_lock != &q->__queue_lock)
elevator_exit(q->elevator); q->queue_lock = &q->__queue_lock;
blk_throtl_exit(q);
blk_put_queue(q); blk_put_queue(q);
} }

View File

@ -479,6 +479,11 @@ static void blk_release_queue(struct kobject *kobj)
blk_sync_queue(q); blk_sync_queue(q);
if (q->elevator)
elevator_exit(q->elevator);
blk_throtl_exit(q);
if (rl->rq_pool) if (rl->rq_pool)
mempool_destroy(rl->rq_pool); mempool_destroy(rl->rq_pool);