2 files changed, 16 insertions, 5 deletions

diff --git a/block/genhd.c b/block/genhd.c
index e2f67902dd02..d261b73b9744 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -611,6 +611,12 @@ void add_disk(struct gendisk *disk)
         register_disk(disk);
         blk_register_queue(disk);
 
+        /*
+         * Take an extra ref on queue which will be put on disk_release()
+         * so that it sticks around as long as @disk is there.
+         */
+        WARN_ON_ONCE(blk_get_queue(disk->queue));
+
         retval = sysfs_create_link(&disk_to_dev(disk)->kobj, &bdi->dev->kobj,
                                    "bdi");
         WARN_ON(retval);
@@ -1095,6 +1101,8 @@ static void disk_release(struct device *dev)
         disk_replace_part_tbl(disk, NULL);
         free_part_stats(&disk->part0);
         free_part_info(&disk->part0);
+        if (disk->queue)
+                blk_put_queue(disk->queue);
         kfree(disk);
 }
 struct class block_class = {
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 95f786ec7f08..1c44b8d54504 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -1085,6 +1085,7 @@ static int __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part);
 static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
 {
         struct gendisk *disk;
+        struct module *owner;
         int ret;
         int partno;
         int perm = 0;
@@ -1110,6 +1111,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
         disk = get_gendisk(bdev->bd_dev, &partno);
         if (!disk)
                 goto out;
+        owner = disk->fops->owner;
 
         disk_block_events(disk);
         mutex_lock_nested(&bdev->bd_mutex, for_part);
@@ -1137,8 +1139,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                         bdev->bd_disk = NULL;
                                         mutex_unlock(&bdev->bd_mutex);
                                         disk_unblock_events(disk);
-                                        module_put(disk->fops->owner);
                                         put_disk(disk);
+                                        module_put(owner);
                                         goto restart;
                                 }
                         }
@@ -1194,8 +1196,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
                                 goto out_unlock_bdev;
                 }
                 /* only one opener holds refs to the module and disk */
-                module_put(disk->fops->owner);
                 put_disk(disk);
+                module_put(owner);
         }
         bdev->bd_openers++;
         if (for_part)
@@ -1215,8 +1217,8 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, int for_part)
  out_unlock_bdev:
         mutex_unlock(&bdev->bd_mutex);
         disk_unblock_events(disk);
-        module_put(disk->fops->owner);
         put_disk(disk);
+        module_put(owner);
  out:
         bdput(bdev);
 
@@ -1442,14 +1444,15 @@ static int __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part)
         if (!bdev->bd_openers) {
                 struct module *owner = disk->fops->owner;
 
-                put_disk(disk);
-                module_put(owner);
                 disk_put_part(bdev->bd_part);
                 bdev->bd_part = NULL;
                 bdev->bd_disk = NULL;
                 if (bdev != bdev->bd_contains)
                         victim = bdev->bd_contains;
                 bdev->bd_contains = NULL;
+
+                put_disk(disk);
+                module_put(owner);
         }
         mutex_unlock(&bdev->bd_mutex);
         bdput(bdev);