mmc: block: Block new req entering queue after its cleanup

Message ID 20170713091758.2975-1-linus.walleij@linaro.org
State New
Headers show

Commit Message

Linus Walleij July 13, 2017, 9:17 a.m.
From: Grzegorz Sluja <grzegorzx.sluja@intel.com>


commit 304419d8a7e9204c5d19b704467b814df8c8f5b1
'mmc: core: Allocate per-request data using the block layer core'
refactored mechanism of queue handling caused mmc_init_request() can
be called just after mmc_cleanup_queue() caused null pointer dereference:

dmesg:
[  683.123791] BUG: unable to handle kernel NULL pointer dereference at (null)
[  683.123801] IP: mmc_init_request+0x2c/0xf0 [mmc_block]
...
[  683.123905] Call Trace:
[  683.123913]  alloc_request_size+0x4f/0x70
[  683.123919]  mempool_alloc+0x5f/0x150
[  683.123925]  ? __enqueue_entity+0x6c/0x70
[  683.123928]  get_request+0x3ad/0x720
[  683.123933]  ? prepare_to_wait_event+0x110/0x110
[  683.123937]  blk_queue_bio+0xc1/0x3a0
[  683.123940]  generic_make_request+0xf8/0x2a0
[  683.123942]  submit_bio+0x75/0x150
[  683.123947]  submit_bio_wait+0x51/0x70
[  683.123951]  blkdev_issue_flush+0x5c/0x90
[  683.123956]  ext4_sync_fs+0x171/0x1b0
[  683.123961]  sync_filesystem+0x73/0x90
[  683.123965]  fsync_bdev+0x24/0x50
[  683.123971]  invalidate_partition+0x24/0x50
[  683.123973]  del_gendisk+0xb2/0x2a0
[  683.123977]  mmc_blk_remove_req.part.38+0x71/0xa0 [mmc_block]
[  683.123980]  mmc_blk_remove+0xba/0x190 [mmc_block]
[  683.123990]  mmc_bus_remove+0x1a/0x20 [mmc_core]
[  683.123995]  device_release_driver_internal+0x141/0x200
[  683.123999]  device_release_driver+0x12/0x20
[  683.124001]  bus_remove_device+0xfd/0x170
[  683.124004]  device_del+0x1e8/0x330
[  683.124012]  mmc_remove_card+0x60/0xc0 [mmc_core]
[  683.124019]  mmc_remove+0x19/0x30 [mmc_core]
[  683.124025]  mmc_stop_host+0xfb/0x1a0 [mmc_core]
[  683.124032]  mmc_remove_host+0x1a/0x40 [mmc_core]
[  683.124037]  sdhci_remove_host+0x2e/0x1c0 [mmc_sdhci]
[  683.124042]  sdhci_pci_remove_slot+0x3f/0x80 [sdhci_pci]
[  683.124045]  sdhci_pci_remove+0x39/0x70 [sdhci_pci]
[  683.124049]  pci_device_remove+0x39/0xc0
[  683.124052]  device_release_driver_internal+0x141/0x200
[  683.124056]  driver_detach+0x3f/0x80
[  683.124059]  bus_remove_driver+0x55/0xd0
[  683.124062]  driver_unregister+0x2c/0x50
[  683.124065]  pci_unregister_driver+0x29/0x90
[  683.124069]  sdhci_driver_exit+0x10/0x4f3 [sdhci_pci]
[  683.124073]  SyS_delete_module+0x171/0x250
[  683.124078]  entry_SYSCALL_64_fastpath+0x1e/0xa9

Set queue DYING flag just before its cleaning blocked new req entering
the queue afterwards.

Signed-off-by: Grzegorz Sluja <grzegorzx.sluja@intel.com>

Signed-off-by: Linus Walleij <linus.walleij@linaro.org>

---
Hi Ulf, forwarding an important fix from Grzegorz at Intel, please
apply!

Linus
---
 drivers/mmc/core/block.c | 1 +
 1 file changed, 1 insertion(+)

-- 
2.9.4

--
To unsubscribe from this list: send the line "unsubscribe linux-mmc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Ulf Hansson July 13, 2017, 9:46 a.m. | #1
On 13 July 2017 at 11:17, Linus Walleij <linus.walleij@linaro.org> wrote:
> From: Grzegorz Sluja <grzegorzx.sluja@intel.com>

>

> commit 304419d8a7e9204c5d19b704467b814df8c8f5b1

> 'mmc: core: Allocate per-request data using the block layer core'

> refactored mechanism of queue handling caused mmc_init_request() can

> be called just after mmc_cleanup_queue() caused null pointer dereference:

>

> dmesg:

> [  683.123791] BUG: unable to handle kernel NULL pointer dereference at (null)

> [  683.123801] IP: mmc_init_request+0x2c/0xf0 [mmc_block]

> ...

> [  683.123905] Call Trace:

> [  683.123913]  alloc_request_size+0x4f/0x70

> [  683.123919]  mempool_alloc+0x5f/0x150

> [  683.123925]  ? __enqueue_entity+0x6c/0x70

> [  683.123928]  get_request+0x3ad/0x720

> [  683.123933]  ? prepare_to_wait_event+0x110/0x110

> [  683.123937]  blk_queue_bio+0xc1/0x3a0

> [  683.123940]  generic_make_request+0xf8/0x2a0

> [  683.123942]  submit_bio+0x75/0x150

> [  683.123947]  submit_bio_wait+0x51/0x70

> [  683.123951]  blkdev_issue_flush+0x5c/0x90

> [  683.123956]  ext4_sync_fs+0x171/0x1b0

> [  683.123961]  sync_filesystem+0x73/0x90

> [  683.123965]  fsync_bdev+0x24/0x50

> [  683.123971]  invalidate_partition+0x24/0x50

> [  683.123973]  del_gendisk+0xb2/0x2a0

> [  683.123977]  mmc_blk_remove_req.part.38+0x71/0xa0 [mmc_block]

> [  683.123980]  mmc_blk_remove+0xba/0x190 [mmc_block]

> [  683.123990]  mmc_bus_remove+0x1a/0x20 [mmc_core]

> [  683.123995]  device_release_driver_internal+0x141/0x200

> [  683.123999]  device_release_driver+0x12/0x20

> [  683.124001]  bus_remove_device+0xfd/0x170

> [  683.124004]  device_del+0x1e8/0x330

> [  683.124012]  mmc_remove_card+0x60/0xc0 [mmc_core]

> [  683.124019]  mmc_remove+0x19/0x30 [mmc_core]

> [  683.124025]  mmc_stop_host+0xfb/0x1a0 [mmc_core]

> [  683.124032]  mmc_remove_host+0x1a/0x40 [mmc_core]

> [  683.124037]  sdhci_remove_host+0x2e/0x1c0 [mmc_sdhci]

> [  683.124042]  sdhci_pci_remove_slot+0x3f/0x80 [sdhci_pci]

> [  683.124045]  sdhci_pci_remove+0x39/0x70 [sdhci_pci]

> [  683.124049]  pci_device_remove+0x39/0xc0

> [  683.124052]  device_release_driver_internal+0x141/0x200

> [  683.124056]  driver_detach+0x3f/0x80

> [  683.124059]  bus_remove_driver+0x55/0xd0

> [  683.124062]  driver_unregister+0x2c/0x50

> [  683.124065]  pci_unregister_driver+0x29/0x90

> [  683.124069]  sdhci_driver_exit+0x10/0x4f3 [sdhci_pci]

> [  683.124073]  SyS_delete_module+0x171/0x250

> [  683.124078]  entry_SYSCALL_64_fastpath+0x1e/0xa9

>

> Set queue DYING flag just before its cleaning blocked new req entering

> the queue afterwards.

>

> Signed-off-by: Grzegorz Sluja <grzegorzx.sluja@intel.com>

> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>


Thanks, applied for fixes!

I added a fixes tag and updated the changelog a bit.

Kind regards
Uffe

> ---

> Hi Ulf, forwarding an important fix from Grzegorz at Intel, please

> apply!

>

> Linus

> ---

>  drivers/mmc/core/block.c | 1 +

>  1 file changed, 1 insertion(+)

>

> diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c

> index 0cfac2d39107..5ddde7dc9075 100644

> --- a/drivers/mmc/core/block.c

> +++ b/drivers/mmc/core/block.c

> @@ -2167,6 +2167,7 @@ static void mmc_blk_remove_req(struct mmc_blk_data *md)

>                  * from being accepted.

>                  */

>                 card = md->queue.card;

> +               blk_set_queue_dying(md->queue.queue);

>                 mmc_cleanup_queue(&md->queue);

>                 if (md->disk->flags & GENHD_FL_UP) {

>                         device_remove_file(disk_to_dev(md->disk), &md->force_ro);

> --

> 2.9.4

>

--
To unsubscribe from this list: send the line "unsubscribe linux-mmc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Shawn Lin July 24, 2017, 9:33 a.m. | #2
Hi

On 2017/7/13 17:46, Ulf Hansson wrote:
> On 13 July 2017 at 11:17, Linus Walleij <linus.walleij@linaro.org> wrote:

>> From: Grzegorz Sluja <grzegorzx.sluja@intel.com>

>>

>> commit 304419d8a7e9204c5d19b704467b814df8c8f5b1

>> 'mmc: core: Allocate per-request data using the block layer core'

>> refactored mechanism of queue handling caused mmc_init_request() can

>> be called just after mmc_cleanup_queue() caused null pointer dereference:

>>

>> dmesg:

>> [  683.123791] BUG: unable to handle kernel NULL pointer dereference at (null)

>> [  683.123801] IP: mmc_init_request+0x2c/0xf0 [mmc_block]

>> ...

>> [  683.123905] Call Trace:

>> [  683.123913]  alloc_request_size+0x4f/0x70

>> [  683.123919]  mempool_alloc+0x5f/0x150

>> [  683.123925]  ? __enqueue_entity+0x6c/0x70

>> [  683.123928]  get_request+0x3ad/0x720

>> [  683.123933]  ? prepare_to_wait_event+0x110/0x110

>> [  683.123937]  blk_queue_bio+0xc1/0x3a0

>> [  683.123940]  generic_make_request+0xf8/0x2a0

>> [  683.123942]  submit_bio+0x75/0x150

>> [  683.123947]  submit_bio_wait+0x51/0x70

>> [  683.123951]  blkdev_issue_flush+0x5c/0x90

>> [  683.123956]  ext4_sync_fs+0x171/0x1b0

>> [  683.123961]  sync_filesystem+0x73/0x90

>> [  683.123965]  fsync_bdev+0x24/0x50

>> [  683.123971]  invalidate_partition+0x24/0x50

>> [  683.123973]  del_gendisk+0xb2/0x2a0

>> [  683.123977]  mmc_blk_remove_req.part.38+0x71/0xa0 [mmc_block]

>> [  683.123980]  mmc_blk_remove+0xba/0x190 [mmc_block]

>> [  683.123990]  mmc_bus_remove+0x1a/0x20 [mmc_core]

>> [  683.123995]  device_release_driver_internal+0x141/0x200

>> [  683.123999]  device_release_driver+0x12/0x20

>> [  683.124001]  bus_remove_device+0xfd/0x170

>> [  683.124004]  device_del+0x1e8/0x330

>> [  683.124012]  mmc_remove_card+0x60/0xc0 [mmc_core]

>> [  683.124019]  mmc_remove+0x19/0x30 [mmc_core]

>> [  683.124025]  mmc_stop_host+0xfb/0x1a0 [mmc_core]

>> [  683.124032]  mmc_remove_host+0x1a/0x40 [mmc_core]

>> [  683.124037]  sdhci_remove_host+0x2e/0x1c0 [mmc_sdhci]

>> [  683.124042]  sdhci_pci_remove_slot+0x3f/0x80 [sdhci_pci]

>> [  683.124045]  sdhci_pci_remove+0x39/0x70 [sdhci_pci]

>> [  683.124049]  pci_device_remove+0x39/0xc0

>> [  683.124052]  device_release_driver_internal+0x141/0x200

>> [  683.124056]  driver_detach+0x3f/0x80

>> [  683.124059]  bus_remove_driver+0x55/0xd0

>> [  683.124062]  driver_unregister+0x2c/0x50

>> [  683.124065]  pci_unregister_driver+0x29/0x90

>> [  683.124069]  sdhci_driver_exit+0x10/0x4f3 [sdhci_pci]

>> [  683.124073]  SyS_delete_module+0x171/0x250

>> [  683.124078]  entry_SYSCALL_64_fastpath+0x1e/0xa9

>>

>> Set queue DYING flag just before its cleaning blocked new req entering

>> the queue afterwards.

>>

>> Signed-off-by: Grzegorz Sluja <grzegorzx.sluja@intel.com>

>> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>

> 

> Thanks, applied for fixes!

> 

> I added a fixes tag and updated the changelog a bit.

> 


It doesn't fix all the issues.

I still can see this problem for running linux-next-20170720 which
already has this fix. I will try to debug it but any suggestion
was welcomed.


[ 1312.684588] Unable to handle kernel NULL pointer dereference at 
virtual address 00000000
[ 1312.685358] user pgtable: 4k pages, 48-bit VAs, pgd = ffff80007bab3000
[ 1312.685939] [0000000000000000] *pgd=000000007a828003, 
*pud=0000000078dce003, *pmd=000000007aab6003, *pte=0000000000000000
[ 1312.686936] Internal error: Oops: 96000007 [#1] PREEMPT SMP
[ 1312.687444] Modules linked in:
[ 1312.687751] CPU: 3 PID: 3507 Comm: umount Tainted: G        W 
4.13.0-rc1-next-20170720-00012-g9d9bf45 #33
[ 1312.688639] Hardware name: Firefly-RK3399 Board (DT)
[ 1312.689085] task: ffff80007a1de200 task.stack: ffff80007a01c000
[ 1312.689624] PC is at mmc_init_request+0x14/0xc4
[ 1312.690041] LR is at alloc_request_size+0x4c/0x74
[ 1312.690465] pc : [<ffff0000087d7150>] lr : [<ffff000008378fe0>] 
pstate: 600001c5
[ 1312.691118] sp : ffff80007a01f8f0
[ 1312.691419] x29: ffff80007a01f8f0 x28: ffff000009020c60
[ 1312.691903] x27: ffff80007a935400 x26: ffff80007b14a568
[ 1312.692387] x25: ffff80007b1820e0 x24: ffff000008378f5c
[ 1312.692871] x23: 0000000000000004 x22: 0000000001000200
[ 1312.693354] x21: 0000000001000200 x20: ffff80007b14a000
[ 1312.693836] x19: ffff80007b14a148 x18: 0000000000000000
[ 1312.694319] x17: 0000000000000000 x16: ffff000008090a70
[ 1312.694801] x15: 0000000000000000 x14: 00002a3000002a29
[ 1312.695284] x13: 00002a2100002a19 x12: 00002a4d00002a49
[ 1312.695767] x11: 00002a4000002a39 x10: 00002a6900002a61
[ 1312.696250] x9 : 0000000000000000 x8 : ffff80007b53a480
[ 1312.696731] x7 : 0000000000000000 x6 : 000000000000003f
[ 1312.697213] x5 : 0000000000000040 x4 : 0000000000000000
[ 1312.697694] x3 : ffff0000087d713c x2 : 0000000001000200
[ 1312.698176] x1 : ffff80007b14a000 x0 : 0000000000000000
[ 1312.698661] Process umount (pid: 3507, stack limit = 0xffff80007a01c000)
[ 1312.699258] Stack: (0xffff80007a01f8f0 to 0xffff80007a020000)
[ 1312.699776] f8e0:                                   ffff80007a01f920 
ffff000008378fe0
[ 1312.700475] f900: ffff80007b1820e0 ffff80007b14a000 ffff80007a935400 
0000000001000200
[ 1312.701174] f920: ffff80007a01f950 ffff00000817ac28 ffff80007b53a400 
ffff80007b53af80
[ 1312.701873] f940: ffff000008378f94 ffff80007b1820e0 ffff80007a01f9a0 
ffff00000837aadc
[ 1312.702573] f960: ffff80007b14a440 ffff80007b1820e0 ffff0000090202e0 
ffff80007b1820e0
[ 1312.703272] f980: ffff000009020000 ffff000009020d78 ffff80007b14a608 
ffff80007a935400
[ 1312.703969] f9a0: ffff80007a01f9e0 ffff000008396580 0000000000000004 
ffff80007b14a400
[ 1312.704667] f9c0: 0000000001000200 ffff80007b14a400 0000000001000200 
0000000001000200
[ 1312.705366] f9e0: ffff80007a01fa50 ffff000008396ac8 0000000000000000 
ffff80007a935400
[ 1312.706065] fa00: 0000000000000001 ffff80007b1820e0 ffff80007a935400 
ffff80007b53a100
[ 1312.706762] fa20: ffff00000822f2e4 ffff000008230104 0000000000000001 
0000000000000100
[ 1312.707460] fa40: 0000000000000001 ffff000009020c48 ffff80007a01fa90 
ffff00000839877c
[ 1312.708159] fa60: ffff000009020c60 ffff80007b1820e0 ffff80007a935400 
ffff000009020c60
[ 1312.708858] fa80: ffff80007a935400 0000000000000000 ffff80007a01fad0 
ffff0000083796bc
[ 1312.709556] faa0: ffff80007a0f4500 ffff80007b1820e0 0000000000000000 
ffff80007a935400
[ 1312.710255] fac0: 0000000000000000 0000000000000000 ffff80007a01fb20 
ffff00000837b050
[ 1312.710953] fae0: ffff80007a0f4500 ffff80007a0f4500 0000000000080000 
0000000000000000
[ 1312.711652] fb00: ffff80007a01fb90 ffff000008375054 ffff80007c37c750 
ffff80007bef7500
[ 1312.712351] fb20: ffff80007a01fb80 ffff00000837b324 ffff80007a0f4500 
0000000000000001
[ 1312.713047] fb40: 0000000000080000 0000000000000000 0000000000000000 
0000000000000000
[ 1312.713746] fb60: ffff80007a01fbb0 ffff000008230d54 0000000000000000 
ffff000008eac000
[ 1312.714444] fb80: ffff80007a01fbf0 ffff00000823226c ffff80007c37c750 
ffff80007a0f4500
[ 1312.715142] fba0: 0000000000080000 ffff80007a01fca0 0000000000080000 
0000000000000000
[ 1312.715840] fbc0: 0000000000000000 0000000000000000 ffff80007a01fbf0 
ffff000008232244
[ 1312.716537] fbe0: ffff80007c37c750 0000000000000008 ffff80007a01fc30 
ffff000008232dac
[ 1312.717237] fc00: ffff80007c37c750 ffff80007a01fca0 0000000000000000 
ffff80007a01fca0
[ 1312.717934] fc20: 0000000000000000 0000000000080000 ffff80007a01fc80 
ffff000008232ea0
[ 1312.718633] fc40: ffff800078d9c000 0000000000000000 ffff0000089bf9a8 
ffff80007bb1e800
[ 1312.719330] fc60: 0000000000000000 00000000000000ff 0000000000000100 
0000000000000001
[ 1312.720030] fc80: ffff80007a01fca0 ffff0000082e050c ffff80007a01fca0 
ffff80007c37c750
[ 1312.720728] fca0: ffff80007a01fd60 ffff0000082e1ed0 000000000000b380 
ffff800078d9c000
[ 1312.721425] fcc0: ffff800079eb3b40 0000000000fae378 0000000000070030 
0000000000000011
[ 1312.722123] fce0: 000000000000018e 000000000000010a ffff000008994000 
ffff80007a1de200
[ 1312.722821] fd00: ffff80007c045cc0 ffff800078d9c048 0000000200001005 
000000080000015e
[ 1312.723518] fd20: 0000000000000ac2 ffff800000000002 0000000000000000 
0000000000000011
[ 1312.724214] fd40: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[ 1312.724914] fd60: ffff80007a01fda0 ffff00000822e320 ffff80007a01fe48 
ffff800079eb3b40
[ 1312.725612] fd80: ffff80007a01fe48 ffff800079eb3b40 ffff80007a01fe48 
ffff80007a01fe48
[ 1312.726312] fda0: ffff80007a01fdc0 ffff00000822e35c ffff80007a01fe48 
ffff80007a01fe10
[ 1312.727010] fdc0: ffff80007a01fde0 ffff00000822e438 0000000000000000 
0000000000000005
[ 1312.727709] fde0: ffff80007a01fe20 ffff00000822e770 00000000ffa85150 
00008000760bc000
[ 1312.728409] fe00: ffffffffffffffff 00000000f79446f6 ffff80007b4abca0 
ffff800079eb3b40
[ 1312.729106] fe20: 0000000000000000 ffff000008082f30 0000000000400000 
000081a4000007ff
[ 1312.729803] fe40: 0000100000000001 0000000000000000 0000000000000000 
0000000000000000
[ 1312.730500] fe60: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[ 1312.731197] fe80: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[ 1312.731893] fea0: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[ 1312.732590] fec0: 0000000000fae378 0000000000000058 00000000ffa85150 
00000000f7a5a000
[ 1312.733288] fee0: 0000000000fae250 00000000ffa85150 00000000f7a5a000 
000000000000010a
[ 1312.733986] ff00: 0000000000fae378 0000000000000000 0000000000013c10 
00000000ffa853d4
[ 1312.734684] ff20: 000000000000010a 00000000ffa850b4 00000000f79b7443 
0000000000000000
[ 1312.735381] ff40: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[ 1312.736077] ff60: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[ 1312.736774] ff80: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[ 1312.737472] ffa0: 0000000000000000 0000000000000000 0000000000000000 
0000000000000000
[ 1312.738169] ffc0: 00000000f79446f6 0000000000070030 0000000000fae378 
000000000000010a
[ 1312.738868] ffe0: 0000000000000000 0000000000000000 ffff80007a01fff0 
ffff80007a01fff0
[ 1312.739559] Call trace:
[ 1312.739793] Exception stack(0xffff80007a01f720 to 0xffff80007a01f850)
[ 1312.740372] f720: ffff80007b14a148 0001000000000000 ffff80007a01f8f0 
ffff0000087d7150
[ 1312.741069] f740: 0000000000000003 0000000000000001 000000010003dce7 
ffff80007bc63600
[ 1312.741767] f760: ffff80007a01f880 0000000000000002 0000000000000000 
00000000016080c0
[ 1312.742464] f780: ffff80007a01f880 ffff80007ad1b7e8 ffff80007be0b000 
0000000000000200
[ 1312.743162] f7a0: ffff80007a01f7c0 ffff00000836798c ffff80007a01f880 
0000000000000800
[ 1312.743859] f7c0: 0000000000000000 ffff80007b14a000 0000000001000200 
ffff0000087d713c
[ 1312.744556] f7e0: 0000000000000000 0000000000000040 000000000000003f 
0000000000000000
[ 1312.745255] f800: ffff80007b53a480 0000000000000000 00002a6900002a61 
00002a4000002a39
[ 1312.745952] f820: 00002a4d00002a49 00002a2100002a19 00002a3000002a29 
0000000000000000
[ 1312.746646] f840: ffff000008090a70 0000000000000000
[ 1312.747092] [<ffff0000087d7150>] mmc_init_request+0x14/0xc4
[ 1312.747597] [<ffff000008378fe0>] alloc_request_size+0x4c/0x74
[ 1312.748120] [<ffff00000817ac28>] mempool_create_node+0xb8/0x17c
[ 1312.748651] [<ffff00000837aadc>] blk_init_rl+0x9c/0x120
[ 1312.749123] [<ffff000008396580>] blkg_alloc+0x110/0x234
[ 1312.749594] [<ffff000008396ac8>] blkg_create+0x424/0x468
[ 1312.750074] [<ffff00000839877c>] blkg_lookup_create+0xd8/0x14c
[ 1312.750603] [<ffff0000083796bc>] generic_make_request_checks+0x368/0x3b0
[ 1312.751201] [<ffff00000837b050>] generic_make_request+0x1c/0x240
[ 1312.751740] [<ffff00000837b324>] submit_bio+0xb0/0x188
[ 1312.752207] [<ffff00000823226c>] submit_bh_wbc+0x130/0x170
[ 1312.752703] [<ffff000008232dac>] ll_rw_block+0xc0/0x128
[ 1312.753176] [<ffff000008232ea0>] __breadahead+0x2c/0x40
[ 1312.753653] [<ffff0000082e050c>] fat_count_free_clusters+0x248/0x254
[ 1312.754225] [<ffff0000082e1ed0>] fat_statfs+0xc0/0xd0
[ 1312.754680] [<ffff00000822e320>] statfs_by_dentry+0x70/0x90
[ 1312.755180] [<ffff00000822e35c>] vfs_statfs+0x1c/0xb0
[ 1312.755634] [<ffff00000822e438>] user_statfs+0x48/0x90
[ 1312.756099] [<ffff00000822e770>] compat_SyS_statfs64+0x20/0x54
[ 1312.756624] [<ffff000008082f30>] el0_svc_naked+0x24/0x28
[ 1312.757110] Code: 910003fd a90153f3 91052033 f940d000 (f9400014)
[ 1312.758176] ---[ end trace d4d57b463eb386ea ]---
[ 1312.758658] note: umount[3507] exited with preempt_count 1



> Kind regards

> Uffe

> 

>> ---

>> Hi Ulf, forwarding an important fix from Grzegorz at Intel, please

>> apply!

>>

>> Linus

>> ---

>>   drivers/mmc/core/block.c | 1 +

>>   1 file changed, 1 insertion(+)

>>

>> diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c

>> index 0cfac2d39107..5ddde7dc9075 100644

>> --- a/drivers/mmc/core/block.c

>> +++ b/drivers/mmc/core/block.c

>> @@ -2167,6 +2167,7 @@ static void mmc_blk_remove_req(struct mmc_blk_data *md)

>>                   * from being accepted.

>>                   */

>>                  card = md->queue.card;

>> +               blk_set_queue_dying(md->queue.queue);

>>                  mmc_cleanup_queue(&md->queue);

>>                  if (md->disk->flags & GENHD_FL_UP) {

>>                          device_remove_file(disk_to_dev(md->disk), &md->force_ro);

>> --

>> 2.9.4

>>

> --

> To unsubscribe from this list: send the line "unsubscribe linux-mmc" in

> the body of a message to majordomo@vger.kernel.org

> More majordomo info at  http://vger.kernel.org/majordomo-info.html

> 

> 

> 


--
To unsubscribe from this list: send the line "unsubscribe linux-mmc" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Patch

diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c
index 0cfac2d39107..5ddde7dc9075 100644
--- a/drivers/mmc/core/block.c
+++ b/drivers/mmc/core/block.c
@@ -2167,6 +2167,7 @@  static void mmc_blk_remove_req(struct mmc_blk_data *md)
 		 * from being accepted.
 		 */
 		card = md->queue.card;
+		blk_set_queue_dying(md->queue.queue);
 		mmc_cleanup_queue(&md->queue);
 		if (md->disk->flags & GENHD_FL_UP) {
 			device_remove_file(disk_to_dev(md->disk), &md->force_ro);