On Mon 14-03-16 18:42:58, Rabin Vincent wrote: > (fixed Jens' address) > > On Thu, Mar 10, 2016 at 06:37:27PM +0100, Jan Kara wrote: > > On Thu 10-03-16 13:26:03, Rabin Vincent wrote: > > > If a block device is closed while iterate_bdevs() is handling it, the > > > following NULL pointer dereference occurs because bdev->b_disk is NULL > > > in bdev_get_queue(), which is called from blk_get_backing_dev_info() (in > > > turn called by the mapping_cap_writeback_dirty() call in > > > __filemap_fdatawrite_range()): > > > > Thanks for spotting the problem. The patch will fix the problem you > > found. But what prevents e.g. flusher thread from trying to writeback > > the block device inode while that gets invalidated at the same moment? > > Don't the sync_block_dev() / bdev_write_inode() calls in __blkdev_put() > prevent this? They don't. They make sure all dirty data is written but flusher thread can still be in the middle of iteration over block device pages. So flusher thread may still hold reference to the block device inode while __blkdev_put() is done with it. Although flusher has nothing to write anymore, it can still call some function where using inode_to_bdi() will result in NULL pointer dereference... Honza -- Jan Kara <jack@xxxxxxxx> SUSE Labs, CR -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
