Merge branch 'for-linus' of git://git.kernel.dk/linux-block

Pull block fixes from Jens Axboe:
 "A small collection of fixes that should go into this cycle.

   - a pull request from Christoph for NVMe, which ended up being
     manually applied to avoid pulling in newer bits in master. Mostly
     fibre channel fixes from James, but also a few fixes from Jon and
     Vijay

   - a pull request from Konrad, with just a single fix for xen-blkback
     from Gustavo.

   - a fuseblk bdi fix from Jan, fixing a regression in this series with
     the dynamic backing devices.

   - a blktrace fix from Shaohua, replacing sscanf() with kstrtoull().

   - a request leak fix for drbd from Lars, fixing a regression in the
     last series with the kref changes. This will go to stable as well"

* 'for-linus' of git://git.kernel.dk/linux-block:
  nvmet: release the sq ref on rdma read errors
  nvmet-fc: remove target cpu scheduling flag
  nvme-fc: stop queues on error detection
  nvme-fc: require target or discovery role for fc-nvme targets
  nvme-fc: correct port role bits
  nvme: unmap CMB and remove sysfs file in reset path
  blktrace: fix integer parse
  fuseblk: Fix warning in super_setup_bdi_name()
  block: xen-blkback: add null check to avoid null pointer dereference
  drbd: fix request leak introduced by locking/atomic, kref: Kill kref_sub()

2 files changed, 20 insertions, 15 deletions

diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index b5730e17b455..656624314f0d 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -315,24 +315,32 @@ void drbd_req_complete(struct drbd_request *req, struct bio_and_error *m)
 }
 
 /* still holds resource->req_lock */
-static int drbd_req_put_completion_ref(struct drbd_request *req, struct bio_and_error *m, int put)
+static void drbd_req_put_completion_ref(struct drbd_request *req, struct bio_and_error *m, int put)
 {
         struct drbd_device *device = req->device;
         D_ASSERT(device, m || (req->rq_state & RQ_POSTPONED));
 
+        if (!put)
+                return;
+
         if (!atomic_sub_and_test(put, &req->completion_ref))
-                return 0;
+                return;
 
         drbd_req_complete(req, m);
 
+        /* local completion may still come in later,
+         * we need to keep the req object around. */
+        if (req->rq_state & RQ_LOCAL_ABORTED)
+                return;
+
         if (req->rq_state & RQ_POSTPONED) {
                 /* don't destroy the req object just yet,
                  * but queue it for retry */
                 drbd_restart_request(req);
-                return 0;
+                return;
         }
 
-        return 1;
+        kref_put(&req->kref, drbd_req_destroy);
 }
 
 static void set_if_null_req_next(struct drbd_peer_device *peer_device, struct drbd_request *req)
@@ -519,12 +527,8 @@ static void mod_rq_state(struct drbd_request *req, struct bio_and_error *m,
         if (req->i.waiting)
                 wake_up(&device->misc_wait);
 
-        if (c_put) {
-                if (drbd_req_put_completion_ref(req, m, c_put))
-                        kref_put(&req->kref, drbd_req_destroy);
-        } else {
-                kref_put(&req->kref, drbd_req_destroy);
-        }
+        drbd_req_put_completion_ref(req, m, c_put);
+        kref_put(&req->kref, drbd_req_destroy);
 }
 
 static void drbd_report_io_error(struct drbd_device *device, struct drbd_request *req)
@@ -1366,8 +1370,7 @@ nodata:
         }
 
 out:
-        if (drbd_req_put_completion_ref(req, &m, 1))
-                kref_put(&req->kref, drbd_req_destroy);
+        drbd_req_put_completion_ref(req, &m, 1);
         spin_unlock_irq(&resource->req_lock);
 
         /* Even though above is a kref_put(), this is safe.
diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c
index 8fe61b5dc5a6..1f3dfaa54d87 100644
--- a/drivers/block/xen-blkback/xenbus.c
+++ b/drivers/block/xen-blkback/xenbus.c
@@ -504,11 +504,13 @@ static int xen_blkbk_remove(struct xenbus_device *dev)
 
         dev_set_drvdata(&dev->dev, NULL);
 
-        if (be->blkif)
+        if (be->blkif) {
                 xen_blkif_disconnect(be->blkif);
 
-        /* Put the reference we set in xen_blkif_alloc(). */
-        xen_blkif_put(be->blkif);
+                /* Put the reference we set in xen_blkif_alloc(). */
+                xen_blkif_put(be->blkif);
+        }
+
         kfree(be->mode);
         kfree(be);
         return 0;