3 files changed, 62 insertions, 20 deletions

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 6a6d475f8e80..feb64d65fbfb 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c
@@ -274,6 +274,10 @@ retry:
                         up_write(&_hash_lock);
 
                         dm_put(md);
+                        if (likely(keep_open_devices))
+                                dm_destroy(md);
+                        else
+                                dm_destroy_immediate(md);
 
                         /*
                          * Some mapped devices may be using other mapped
@@ -644,17 +648,19 @@ static int dev_create(struct dm_ioctl *param, size_t param_size)
                 return r;
 
         r = dm_hash_insert(param->name, *param->uuid ? param->uuid : NULL, md);
-        if (r)
-                goto out;
+        if (r) {
+                dm_put(md);
+                dm_destroy(md);
+                return r;
+        }
 
         param->flags &= ~DM_INACTIVE_PRESENT_FLAG;
 
         __dev_status(md, param);
 
-out:
         dm_put(md);
 
-        return r;
+        return 0;
 }
 
 /*
@@ -748,6 +754,7 @@ static int dev_remove(struct dm_ioctl *param, size_t param_size)
                 param->flags |= DM_UEVENT_GENERATED_FLAG;
 
         dm_put(md);
+        dm_destroy(md);
         return 0;
 }
 
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index ba6934c3e2c5..a503b95ecbfb 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -20,6 +20,7 @@
 #include <linux/slab.h>
 #include <linux/idr.h>
 #include <linux/hdreg.h>
+#include <linux/delay.h>
 
 #include <trace/events/block.h>
 
@@ -2171,6 +2172,7 @@ void dm_set_mdptr(struct mapped_device *md, void *ptr)
 void dm_get(struct mapped_device *md)
 {
         atomic_inc(&md->holders);
+        BUG_ON(test_bit(DMF_FREEING, &md->flags));
 }
 
 const char *dm_device_name(struct mapped_device *md)
@@ -2179,27 +2181,55 @@ const char *dm_device_name(struct mapped_device *md)
 }
 EXPORT_SYMBOL_GPL(dm_device_name);
 
-void dm_put(struct mapped_device *md)
+static void __dm_destroy(struct mapped_device *md, bool wait)
 {
         struct dm_table *map;
 
-        BUG_ON(test_bit(DMF_FREEING, &md->flags));
+        might_sleep();
 
-        if (atomic_dec_and_lock(&md->holders, &_minor_lock)) {
-                map = dm_get_live_table(md);
-                idr_replace(&_minor_idr, MINOR_ALLOCED,
-                            MINOR(disk_devt(dm_disk(md))));
-                set_bit(DMF_FREEING, &md->flags);
-                spin_unlock(&_minor_lock);
-                if (!dm_suspended_md(md)) {
-                        dm_table_presuspend_targets(map);
-                        dm_table_postsuspend_targets(map);
-                }
-                dm_sysfs_exit(md);
-                dm_table_put(map);
-                dm_table_destroy(__unbind(md));
-                free_dev(md);
+        spin_lock(&_minor_lock);
+        map = dm_get_live_table(md);
+        idr_replace(&_minor_idr, MINOR_ALLOCED, MINOR(disk_devt(dm_disk(md))));
+        set_bit(DMF_FREEING, &md->flags);
+        spin_unlock(&_minor_lock);
+
+        if (!dm_suspended_md(md)) {
+                dm_table_presuspend_targets(map);
+                dm_table_postsuspend_targets(map);
         }
+
+        /*
+         * Rare, but there may be I/O requests still going to complete,
+         * for example.  Wait for all references to disappear.
+         * No one should increment the reference count of the mapped_device,
+         * after the mapped_device state becomes DMF_FREEING.
+         */
+        if (wait)
+                while (atomic_read(&md->holders))
+                        msleep(1);
+        else if (atomic_read(&md->holders))
+                DMWARN("%s: Forcibly removing mapped_device still in use! (%d users)",
+                       dm_device_name(md), atomic_read(&md->holders));
+
+        dm_sysfs_exit(md);
+        dm_table_put(map);
+        dm_table_destroy(__unbind(md));
+        free_dev(md);
+}
+
+void dm_destroy(struct mapped_device *md)
+{
+        __dm_destroy(md, true);
+}
+
+void dm_destroy_immediate(struct mapped_device *md)
+{
+        __dm_destroy(md, false);
+}
+
+void dm_put(struct mapped_device *md)
+{
+        atomic_dec(&md->holders);
 }
 EXPORT_SYMBOL_GPL(dm_put);
 
diff --git a/drivers/md/dm.h b/drivers/md/dm.h
index bad1724d4869..8223671e4901 100644
--- a/drivers/md/dm.h
+++ b/drivers/md/dm.h
@@ -122,6 +122,11 @@ void dm_linear_exit(void);
 int dm_stripe_init(void);
 void dm_stripe_exit(void);
 
+/*
+ * mapped_device operations
+ */
+void dm_destroy(struct mapped_device *md);
+void dm_destroy_immediate(struct mapped_device *md);
 int dm_open_count(struct mapped_device *md);
 int dm_lock_for_deletion(struct mapped_device *md);