After commit 1abec4fdbb142e3ccb6ce99832fae42129134a96, "block: make
blk_init_free_list and elevator_init idempotent", we're seeing kernel
panics in our s390 tape block device driver. The panic is triggered
because our driver tries to replace the default elevator with a noop
elevator by calling elevator_exit() directly followed by elevator_init().
Since the commit, elevator_init() returns 0 if request_queue->elevator
is non-null, even though it does not install a new elevator. As a
result, the next access to the elevator finds a pointer to the old one
which was already freed and a panic is triggered. Our current fix
consists of setting the elevator pointer to NULL after elevator_exit().
There is at least one other driver where the problem currently exists
(drivers/block/mg_disk.c, author on cc) and another s390 driver where
the problem was only accidentally fixed before 2.6.35. I'm wondering if
there's a better solution (apart from not forcing an elevator) and would
like to hear everyone's opinion on this matter. How about declaring
elevator_switch() non-static, for example?
Regards,
Peter Oberparleiter
On Mon, Aug 16 2010 at 10:52am -0400,
Peter Oberparleiter <[email protected]> wrote:
> After commit 1abec4fdbb142e3ccb6ce99832fae42129134a96, "block: make
> blk_init_free_list and elevator_init idempotent", we're seeing
> kernel panics in our s390 tape block device driver. The panic is
> triggered because our driver tries to replace the default elevator
> with a noop elevator by calling elevator_exit() directly followed by
> elevator_init().
Maybe we should look to export elevator_switch() -- rather than
confining its use to the sysfs interface.
> Since the commit, elevator_init() returns 0 if
> request_queue->elevator is non-null, even though it does not install
> a new elevator. As a result, the next access to the elevator finds a
> pointer to the old one which was already freed and a panic is
> triggered. Our current fix consists of setting the elevator pointer
> to NULL after elevator_exit().
elevator_exit() triggers a call, via kobj, to elevator_release() which
doesn't have access to the request_queue to reset it.
Unfortunately, commit 1abec4fdbb imposes that the elevator_exit() caller
must take care to reset q->elevator to NULL -- like dasd_alloc_queue()
does.
Though I suppose we _could_ pass request_queue to elevator_exit.
> There is at least one other driver where the problem currently
> exists (drivers/block/mg_disk.c, author on cc) and another s390
> driver where the problem was only accidentally fixed before 2.6.35.
> I'm wondering if there's a better solution (apart from not forcing
> an elevator) and would like to hear everyone's opinion on this
> matter. How about declaring elevator_switch() non-static, for
> example?
Right, updating drivers/block/mg_disk.c and drivers/s390/block/dasd.c to
use elevator_switch would work.
Mike