There is a bug in the aoe driver module where every forcible removal of
an aoe device (eg. "rmmod aoe" with aoe devices available or "aoe-flush
ex.x") leads to a page fault.
The code in freedev() calls blk_mq_free_tag_set() before running
blk_cleanup_queue() which leads to this issue
(drivers/block/aoe/aoedev.c L281ff).
This issue was fixed upstream in commit 6560ec9 (aoe: use
blk_mq_alloc_disk and blk_cleanup_disk) with the introduction and use of
the function blk_cleanup_disk().
This patch applies to kernels 5.4 and 5.10.
The function calls are reordered to match the behavior of
blk_cleanup_disk() to mitigate this issue.
Fixes: 3582dd2 (aoe: convert aoeblk to blk-mq)
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=215647
Signed-off-by: Valentin Kleibel <valentin@xxxxxxxx>
---
drivers/block/aoe/aoedev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/aoe/aoedev.c b/drivers/block/aoe/aoedev.c
index e2ea2356da06..08c98ea724ea 100644
--- a/drivers/block/aoe/aoedev.c
+++ b/drivers/block/aoe/aoedev.c
@@ -277,9 +277,9 @@ freedev(struct aoedev *d)
if (d->gd) {
aoedisk_rm_debugfs(d);
del_gendisk(d->gd);
+ blk_cleanup_queue(d->blkq);
put_disk(d->gd);
blk_mq_free_tag_set(&d->tag_set);
- blk_cleanup_queue(d->blkq);
}
t = d->targets;
e = t + d->ntargets;