Patch "xen/blkback: fix disconnect while I/Os in flight" has been added to the 4.9-stable tree

This is a note to let you know that I've just added the patch titled

xen/blkback: fix disconnect while I/Os in flight

to the 4.9-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
xen-blkback-fix-disconnect-while-i-os-in-flight.patch
and it can be found in the queue-4.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Juergen Gross <[email protected]>
Date: Thu, 18 May 2017 17:28:47 +0200
Subject: xen/blkback: fix disconnect while I/Os in flight
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From: Juergen Gross <[email protected]>

commit 46464411307746e6297a034a9983a22c9dfc5a0c upstream.

Today disconnecting xen-blkback is broken in case there are still I/Os in flight: xen_blkif_disconnect() will bail out early without releasing all resources in the hope it will be called again when the last request has terminated. This, however, won't happen as xen_blkif_free() won't be called on termination of the last running
request: xen_blkif_put() won't decrement the blkif refcnt to 0 as xen_blkif_disconnect() didn't finish before thus some xen_blkif_put() calls in xen_blkif_disconnect() didn't happen.

To solve this deadlock xen_blkif_disconnect() and xen_blkif_alloc_rings() shouldn't use xen_blkif_put() and xen_blkif_get() but use some other way to do their accounting of resources.

This at once fixes another error in xen_blkif_disconnect(): when it returned early with -EBUSY for another ring than 0 it would call xen_blkif_put() again for already handled rings on a subsequent call. This will lead to inconsistencies in the refcnt handling.

---
 drivers/block/xen-blkback/common.h |    1 +
 drivers/block/xen-blkback/xenbus.c |    7 +++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

@@ -281,6 +281,7 @@ struct xen_blkif_ring {
 
 	wait_queue_head_t	wq;
 	atomic_t		inflight;
+	bool			active;
 	/* One thread per blkif ring. */
 	struct task_struct	*xenblkd;
 	unsigned int		waiting_reqs;

@@ -159,7 +159,7 @@ static int xen_blkif_alloc_rings(struct
 		init_waitqueue_head(&ring->shutdown_wq);
 		ring->blkif = blkif;
 		ring->st_print = jiffies;
-		xen_blkif_get(blkif);
+		ring->active = true;
 	}
 
 	return 0;

@@ -249,6 +249,9 @@ static int xen_blkif_disconnect(struct x
 		struct xen_blkif_ring *ring = &blkif->rings[r];
 		unsigned int i = 0;
 
+		if (!ring->active)
+			continue;
+
 		if (ring->xenblkd) {
 			kthread_stop(ring->xenblkd);
 			wake_up(&ring->shutdown_wq);

@@ -296,7 +299,7 @@ static int xen_blkif_disconnect(struct x
 		BUG_ON(ring->free_pages_num != 0);
 		BUG_ON(ring->persistent_gnt_c != 0);
 		WARN_ON(i != (XEN_BLKIF_REQS_PER_PAGE * blkif->nr_ring_pages));
-		xen_blkif_put(blkif);
+		ring->active = false;
 	}
 	blkif->nr_ring_pages = 0;
 	/*

Patches currently in stable-queue which might be from [email protected] are

queue-4.9/xen-blkback-fix-disconnect-while-i-os-in-flight.patch