block: Free queue resources at blk_release_queue() (Closes: #631187)
svn path=/dists/sid/linux-2.6/; revision=18115
This commit is contained in:
parent
b71496a759
commit
da389ea4fb
|
@ -4,6 +4,7 @@ linux-2.6 (3.0.0-5) UNRELEASED; urgency=low
|
||||||
* Ignore ABI change in rt2800lib (fixes FTBFS on several architectures)
|
* Ignore ABI change in rt2800lib (fixes FTBFS on several architectures)
|
||||||
* fm801: Fix double free in case of error in tuner detection
|
* fm801: Fix double free in case of error in tuner detection
|
||||||
* fm801: Gracefully handle failure of tuner auto-detect (Closes: #641946)
|
* fm801: Gracefully handle failure of tuner auto-detect (Closes: #641946)
|
||||||
|
* block: Free queue resources at blk_release_queue() (Closes: #631187)
|
||||||
|
|
||||||
-- Ben Hutchings <ben@decadent.org.uk> Tue, 20 Sep 2011 23:50:35 +0100
|
-- Ben Hutchings <ben@decadent.org.uk> Tue, 20 Sep 2011 23:50:35 +0100
|
||||||
|
|
||||||
|
|
65
debian/patches/bugfix/all/block-Free-queue-resources-at-blk_release_queue.patch
vendored
Normal file
65
debian/patches/bugfix/all/block-Free-queue-resources-at-blk_release_queue.patch
vendored
Normal file
|
@ -0,0 +1,65 @@
|
||||||
|
From: Hannes Reinecke <hare@suse.de>
|
||||||
|
Subject: [PATCH] block: Free queue resources at blk_release_queue()
|
||||||
|
Date: Thu, 22 Sep 2011 15:18:33 +0200
|
||||||
|
|
||||||
|
A kernel crash is observed when a mounted ext3/ext4 filesystem
|
||||||
|
is physically removed.
|
||||||
|
The problem is that blk_cleanup_queue() frees up some resources
|
||||||
|
eg by calling elevator_exit(), which are not checked for in
|
||||||
|
normal operation.
|
||||||
|
So we should rather move these calls to the destructor function
|
||||||
|
blk_release_queue() as at that point all remaining references
|
||||||
|
are gone.
|
||||||
|
However, in doing so we have to ensure that any externally
|
||||||
|
supplied queue_lock is disconnected as the driver might
|
||||||
|
free up the lock after the call of blk_cleanup_queue(),
|
||||||
|
|
||||||
|
Signed-off-by: Hannes Reinecke <hare@suse.de>
|
||||||
|
|
||||||
|
diff --git a/block/blk-core.c b/block/blk-core.c
|
||||||
|
index 90e1ffd..81a431b 100644
|
||||||
|
--- a/block/blk-core.c
|
||||||
|
+++ b/block/blk-core.c
|
||||||
|
@@ -348,9 +348,10 @@ void blk_put_queue(struct request_queue *q)
|
||||||
|
EXPORT_SYMBOL(blk_put_queue);
|
||||||
|
|
||||||
|
/*
|
||||||
|
- * Note: If a driver supplied the queue lock, it should not zap that lock
|
||||||
|
- * unexpectedly as some queue cleanup components like elevator_exit() and
|
||||||
|
- * blk_throtl_exit() need queue lock.
|
||||||
|
+ * Note: If a driver supplied the queue lock, it is disconnected
|
||||||
|
+ * by this function. The actual state of the lock doesn't matter
|
||||||
|
+ * here as the request_queue isn't accessible after this point
|
||||||
|
+ * (QUEUE_FLAG_DEAD is set) and no other requests will be queued.
|
||||||
|
*/
|
||||||
|
void blk_cleanup_queue(struct request_queue *q)
|
||||||
|
{
|
||||||
|
@@ -367,10 +368,8 @@ void blk_cleanup_queue(struct request_queue *q)
|
||||||
|
queue_flag_set_unlocked(QUEUE_FLAG_DEAD, q);
|
||||||
|
mutex_unlock(&q->sysfs_lock);
|
||||||
|
|
||||||
|
- if (q->elevator)
|
||||||
|
- elevator_exit(q->elevator);
|
||||||
|
-
|
||||||
|
- blk_throtl_exit(q);
|
||||||
|
+ if (q->queue_lock != &q->__queue_lock)
|
||||||
|
+ q->queue_lock = &q->__queue_lock;
|
||||||
|
|
||||||
|
blk_put_queue(q);
|
||||||
|
}
|
||||||
|
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
|
||||||
|
index 0ee17b5..a5a756b 100644
|
||||||
|
--- a/block/blk-sysfs.c
|
||||||
|
+++ b/block/blk-sysfs.c
|
||||||
|
@@ -477,6 +477,11 @@ static void blk_release_queue(struct kobject *kobj)
|
||||||
|
|
||||||
|
blk_sync_queue(q);
|
||||||
|
|
||||||
|
+ if (q->elevator)
|
||||||
|
+ elevator_exit(q->elevator);
|
||||||
|
+
|
||||||
|
+ blk_throtl_exit(q);
|
||||||
|
+
|
||||||
|
if (rl->rq_pool)
|
||||||
|
mempool_destroy(rl->rq_pool);
|
||||||
|
|
|
@ -1,2 +1,3 @@
|
||||||
+ bugfix/all/fm801-Fix-double-free-in-case-of-error-in-tuner-dete.patch
|
+ bugfix/all/fm801-Fix-double-free-in-case-of-error-in-tuner-dete.patch
|
||||||
+ bugfix/all/fm801-Gracefully-handle-failure-of-tuner-auto-detect.patch
|
+ bugfix/all/fm801-Gracefully-handle-failure-of-tuner-auto-detect.patch
|
||||||
|
+ bugfix/all/block-Free-queue-resources-at-blk_release_queue.patch
|
||||||
|
|
Loading…
Reference in New Issue