This is a note to let you know that I've just added the patch titled rbd: complete notifies before cleaning up osd_client and rbd_dev to the 3.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: rbd-complete-notifies-before-cleaning-up-osd_client-and-rbd_dev.patch and it can be found in the queue-3.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From 9abc59908e0c5f983aaa91150da32d5b62cf60b7 Mon Sep 17 00:00:00 2001 From: Josh Durgin <josh.durgin@xxxxxxxxxxx> Date: Thu, 29 Aug 2013 17:31:03 -0700 Subject: rbd: complete notifies before cleaning up osd_client and rbd_dev From: Josh Durgin <josh.durgin@xxxxxxxxxxx> commit 9abc59908e0c5f983aaa91150da32d5b62cf60b7 upstream. To ensure rbd_dev is not used after it's released, flush all pending notify callbacks before calling rbd_dev_image_release(). No new notifies can be added to the queue at this point because the watch has already be unregistered with the osd_client. Signed-off-by: Josh Durgin <josh.durgin@xxxxxxxxxxx> Reviewed-by: Alex Elder <elder@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/block/rbd.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/block/rbd.c +++ b/drivers/block/rbd.c @@ -5150,6 +5150,13 @@ static ssize_t rbd_remove(struct bus_typ ret = rbd_dev_header_watch_sync(rbd_dev, false); if (ret) rbd_warn(rbd_dev, "failed to cancel watch event (%d)\n", ret); + + /* + * flush remaining watch callbacks - these must be complete + * before the osd_client is shutdown + */ + dout("%s: flushing notifies", __func__); + ceph_osdc_flush_notifies(&rbd_dev->rbd_client->client->osdc); rbd_dev_image_release(rbd_dev); module_put(THIS_MODULE); ret = count; Patches currently in stable-queue which might be from josh.durgin@xxxxxxxxxxx are queue-3.10/rbd-make-rbd_obj_notify_ack-synchronous.patch queue-3.10/libceph-add-function-to-ensure-notifies-are-complete.patch queue-3.10/rbd-fix-buffer-size-for-writes-to-images-with-snapshots.patch queue-3.10/rbd-fix-use-after-free-of-rbd_dev-disk.patch queue-3.10/rbd-complete-notifies-before-cleaning-up-osd_client-and-rbd_dev.patch queue-3.10/libceph-add-lingering-request-reference-when-registered.patch queue-3.10/rbd-fix-null-dereference-in-dout.patch queue-3.10/rbd-ignore-unmapped-snapshots-that-no-longer-exist.patch queue-3.10/rbd-set-removing-flag-while-holding-list-lock.patch queue-3.10/rbd-flush-dcache-after-zeroing-page-data.patch queue-3.10/rbd-fix-error-handling-from-rbd_snap_name.patch queue-3.10/rbd-protect-against-concurrent-unmaps.patch -- To unsubscribe from this list: send the line "unsubscribe stable" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html