Re: [PATCH] block: protect iterate_bdevs() against concurrent close

[Jan Kara]

On Mon 14-03-16 18:42:58, Rabin Vincent wrote:
> (fixed Jens' address)
> 
> On Thu, Mar 10, 2016 at 06:37:27PM +0100, Jan Kara wrote:
> > On Thu 10-03-16 13:26:03, Rabin Vincent wrote:
> > > If a block device is closed while iterate_bdevs() is handling it, the
> > > following NULL pointer dereference occurs because bdev->b_disk is NULL
> > > in bdev_get_queue(), which is called from blk_get_backing_dev_info() (in
> > > turn called by the mapping_cap_writeback_dirty() call in
> > > __filemap_fdatawrite_range()):
> > 
> > Thanks for spotting the problem. The patch will fix the problem you
> > found.  But what prevents e.g. flusher thread from trying to writeback
> > the block device inode while that gets invalidated at the same moment?
> 
> Don't the sync_block_dev() / bdev_write_inode() calls in __blkdev_put()
> prevent this?

They don't. They make sure all dirty data is written but flusher thread can
still be in the middle of iteration over block device pages. So flusher
thread may still hold reference to the block device inode while
__blkdev_put() is done with it. Although flusher has nothing to write
anymore, it can still call some function where using inode_to_bdi() will
result in NULL pointer dereference...

								Honza
-- 
Jan Kara <jack@xxxxxxxx>
SUSE Labs, CR