)]}'
{
  "commit": "f992ae801a7dec34a4ed99a6598bbbbfb82af4fb",
  "tree": "5c8892f67867cb09e9c3c046f881e56200926ff8",
  "parents": [
    "e67b77c791ca2778198c9e7088f3266ed2da7a55"
  ],
  "author": {
    "name": "Tejun Heo",
    "email": "tj@kernel.org",
    "time": "Mon Oct 17 13:42:43 2011 +0200"
  },
  "committer": {
    "name": "Jens Axboe",
    "email": "axboe@kernel.dk",
    "time": "Mon Oct 24 16:24:31 2011 +0200"
  },
  "message": "block: make gendisk hold a reference to its queue\n\nThe following command sequence triggers an oops.\n\n# mount /dev/sdb1 /mnt\n# echo 1 \u003e /sys/class/scsi_device/0\\:0\\:1\\:0/device/delete\n# umount /mnt\n\n general protection fault: 0000 [#1] PREEMPT SMP\n CPU 2\n Modules linked in:\n\n Pid: 791, comm: umount Not tainted 3.1.0-rc3-work+ #8 Bochs Bochs\n RIP: 0010:[\u003cffffffff810d0879\u003e]  [\u003cffffffff810d0879\u003e] __lock_acquire+0x389/0x1d60\n...\n Call Trace:\n  [\u003cffffffff810d2845\u003e] lock_acquire+0x95/0x140\n  [\u003cffffffff81aed87b\u003e] _raw_spin_lock+0x3b/0x50\n  [\u003cffffffff811573bc\u003e] bdi_lock_two+0x5c/0x70\n  [\u003cffffffff811c2f6c\u003e] bdev_inode_switch_bdi+0x4c/0xf0\n  [\u003cffffffff811c3fcb\u003e] __blkdev_put+0x11b/0x1d0\n  [\u003cffffffff811c4010\u003e] __blkdev_put+0x160/0x1d0\n  [\u003cffffffff811c40df\u003e] blkdev_put+0x5f/0x190\n  [\u003cffffffff8118f18d\u003e] kill_block_super+0x4d/0x80\n  [\u003cffffffff8118f4a5\u003e] deactivate_locked_super+0x45/0x70\n  [\u003cffffffff8119003a\u003e] deactivate_super+0x4a/0x70\n  [\u003cffffffff811ac4ad\u003e] mntput_no_expire+0xed/0x130\n  [\u003cffffffff811acf2e\u003e] sys_umount+0x7e/0x3a0\n  [\u003cffffffff81aeeeab\u003e] system_call_fastpath+0x16/0x1b\n\nThis is because bdev holds on to disk but disk doesn\u0027t pin the\nassociated queue.  If a SCSI device is removed while the device is\nstill open, the sdev puts the base reference to the queue on release.\nWhen the bdev is finally released, the associated queue is already\ngone along with the bdi and bdev_inode_switch_bdi() ends up\ndereferencing already freed bdi.\n\nEven if it were not for this bug, disk not holding onto the associated\nqueue is very unusual and error-prone.\n\nFix it by making add_disk() take an extra reference to its queue and\nput it on disk_release() and ensuring that disk and its fops owner are\nput in that order after all accesses to the disk and queue are\ncomplete.\n\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\nCc: Jens Axboe \u003caxboe@kernel.dk\u003e\nCc: stable@kernel.org\nSigned-off-by: Jens Axboe \u003caxboe@kernel.dk\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e2f67902dd024ed2f07abdfc190c73558d2ddb7b",
      "old_mode": 33188,
      "old_path": "block/genhd.c",
      "new_id": "d261b73b9744f033eb59f2b8075bc755c2d2780c",
      "new_mode": 33188,
      "new_path": "block/genhd.c"
    },
    {
      "type": "modify",
      "old_id": "95f786ec7f088f1c85b7e82dfd01fe9bb7246fe3",
      "old_mode": 33188,
      "old_path": "fs/block_dev.c",
      "new_id": "1c44b8d54504e1c633774fd6befe966f0c1e7dc1",
      "new_mode": 33188,
      "new_path": "fs/block_dev.c"
    }
  ]
}