On Mon, Oct 18, 2021 at 07:58:07PM +0800, Zqiang wrote:
> When adding partitions to the disk, the reference count of the disk
> object is increased. then alloc partition device and called
> device_add(), if the device_add() return error, the reference
> count of the disk object will be reduced twice, at put_device(pdev)
> and put_disk(disk). this leads to the end of the object's life cycle
> prematurely, and trigger following calltrace.
>
> __init_work+0x2d/0x50 kernel/workqueue.c:519
> synchronize_rcu_expedited+0x3af/0x650 kernel/rcu/tree_exp.h:847
> bdi_remove_from_list mm/backing-dev.c:938 [inline]
> bdi_unregister+0x17f/0x5c0 mm/backing-dev.c:946
> release_bdi+0xa1/0xc0 mm/backing-dev.c:968
> kref_put include/linux/kref.h:65 [inline]
> bdi_put+0x72/0xa0 mm/backing-dev.c:976
> bdev_free_inode+0x11e/0x220 block/bdev.c:408
> i_callback+0x3f/0x70 fs/inode.c:226
> rcu_do_batch kernel/rcu/tree.c:2508 [inline]
> rcu_core+0x76d/0x16c0 kernel/rcu/tree.c:2743
> __do_softirq+0x1d7/0x93b kernel/softirq.c:558
> invoke_softirq kernel/softirq.c:432 [inline]
> __irq_exit_rcu kernel/softirq.c:636 [inline]
> irq_exit_rcu+0xf2/0x130 kernel/softirq.c:648
> sysvec_apic_timer_interrupt+0x93/0xc0
>
> Return directly after calling the put_device().
>
> Reported-by: Hao Sun <sunhao.th@xxxxxxxxx>
> Signed-off-by: Zqiang <qiang.zhang1211@xxxxxxxxx>
Fixes: 9d3b8813895d ("block: change the refcounting for partitions")
Reviewed-by: Matthew Wilcox (Oracle) <willy@xxxxxxxxxxxxx>
