Merge tag 'dm-4.0-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm

Pull device mapper fix from Mike Snitzer:
 "Fix DM core device cleanup regression -- due to a latent race that was
  exposed by the bdi changes that were introduced during the 4.0 merge"

* tag 'dm-4.0-fix-2' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:
  dm: fix add_disk() NULL pointer due to race with free_dev()

1 files changed, 16 insertions, 10 deletions

diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 9b641b38b857..8001fe9e3434 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -433,7 +433,6 @@ static int dm_blk_open(struct block_device *bdev, fmode_t mode)
 
         dm_get(md);
         atomic_inc(&md->open_count);
-
 out:
         spin_unlock(&_minor_lock);
 
@@ -442,16 +441,20 @@ out:
 
 static void dm_blk_close(struct gendisk *disk, fmode_t mode)
 {
-        struct mapped_device *md = disk->private_data;
+        struct mapped_device *md;
 
         spin_lock(&_minor_lock);
 
+        md = disk->private_data;
+        if (WARN_ON(!md))
+                goto out;
+
         if (atomic_dec_and_test(&md->open_count) &&
             (test_bit(DMF_DEFERRED_REMOVE, &md->flags)))
                 queue_work(deferred_remove_workqueue, &deferred_remove_work);
 
         dm_put(md);
-
+out:
         spin_unlock(&_minor_lock);
 }
 
@@ -2241,7 +2244,6 @@ static void free_dev(struct mapped_device *md)
         int minor = MINOR(disk_devt(md->disk));
 
         unlock_fs(md);
-        bdput(md->bdev);
         destroy_workqueue(md->wq);
 
         if (md->kworker_task)
@@ -2252,19 +2254,22 @@ static void free_dev(struct mapped_device *md)
                 mempool_destroy(md->rq_pool);
         if (md->bs)
                 bioset_free(md->bs);
-        blk_integrity_unregister(md->disk);
-        del_gendisk(md->disk);
+
         cleanup_srcu_struct(&md->io_barrier);
         free_table_devices(&md->table_devices);
-        free_minor(minor);
+        dm_stats_cleanup(&md->stats);
 
         spin_lock(&_minor_lock);
         md->disk->private_data = NULL;
         spin_unlock(&_minor_lock);
-
+        if (blk_get_integrity(md->disk))
+                blk_integrity_unregister(md->disk);
+        del_gendisk(md->disk);
         put_disk(md->disk);
         blk_cleanup_queue(md->queue);
-        dm_stats_cleanup(&md->stats);
+        bdput(md->bdev);
+        free_minor(minor);
+
         module_put(THIS_MODULE);
         kfree(md);
 }
@@ -2642,8 +2647,9 @@ static void __dm_destroy(struct mapped_device *md, bool wait)
 
         might_sleep();
 
-        spin_lock(&_minor_lock);
         map = dm_get_live_table(md, &srcu_idx);
+
+        spin_lock(&_minor_lock);
         idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md))));
         set_bit(DMF_FREEING, &md->flags);
         spin_unlock(&_minor_lock);