From: Daan De Meyer Commit 267ec4d7223a ("loop: fix partition scan race between udev and loop_reread_partitions()") stopped disk_force_media_change() from setting GD_NEED_PART_SCAN. That bit did more than request a rescan: bdev_disk_changed() drops every partition before it consults disk_has_partscan(), so the lazy scan on the next open was also what removed partitions from a loop device without LO_FLAGS_PARTSCAN. Such devices are not unusual. bdev_add_partition() only rejects GENHD_FL_NO_PART disks, so BLKPG_ADD_PARTITION works while GD_SUPPRESS_PART_SCAN is set, and parted, libfdisk and systemd all fall back to BLKPG when BLKRRPART fails with -EINVAL, which is what a loop device without LO_FLAGS_PARTSCAN returns. loop_change_fd() only rescans when LO_FLAGS_PARTSCAN is set, so those partitions now survive the backing file swap and keep describing the old file. The new backing file must have the same size, but its partition table can be completely different, leaving the partition devices mapping the wrong ranges. Call loop_reread_partitions() unconditionally. Without LO_FLAGS_PARTSCAN, blk_add_partitions() returns early, so this drops the stale partitions without scanning the new backing file. Fixes: 267ec4d7223a ("loop: fix partition scan race between udev and loop_reread_partitions()") Cc: stable@vger.kernel.org Signed-off-by: Daan De Meyer --- drivers/block/loop.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 1faecef33009..416a9c651f97 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -538,7 +538,6 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, struct file *old_file; unsigned int memflags; int error; - bool partscan; bool is_loop; if (!file) @@ -592,7 +591,6 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, loop_assign_backing_file(lo, file); loop_update_dio(lo); blk_mq_unfreeze_queue(lo->lo_queue, memflags); - partscan = lo->lo_flags & LO_FLAGS_PARTSCAN; loop_global_unlock(lo, is_loop); /* @@ -610,8 +608,12 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, */ fput(old_file); dev_set_uevent_suppress(disk_to_dev(lo->lo_disk), 0); - if (partscan) - loop_reread_partitions(lo); + /* + * Rescan or, without LO_FLAGS_PARTSCAN, just drop the partitions of the + * old backing file. They can exist without LO_FLAGS_PARTSCAN as they may + * have been added manually with BLKPG. + */ + loop_reread_partitions(lo); error = 0; done: -- 2.54.0 From: Daan De Meyer Commit 267ec4d7223a ("loop: fix partition scan race between udev and loop_reread_partitions()") stopped disk_force_media_change() from setting GD_NEED_PART_SCAN. Besides requesting a rescan, that bit was what removed stale partitions on the next open, as bdev_disk_changed() drops all partitions before it consults disk_has_partscan(). nbd_clear_sock_ioctl() relied on that. It zeroes the capacity through nbd_bdev_reset(), but nothing removes the partitions of the disconnected device anymore. With the default max_part=16 they linger until the next connect sets GD_NEED_PART_SCAN again. With max_part=0 nothing ever sets it, so they are never removed at all, even though nbd does not set GENHD_FL_NO_PART and partitions can therefore still be added with BLKPG. Set GD_NEED_PART_SCAN in nbd_clear_sock_ioctl() so the partitions are dropped on the next open. Calling bdev_disk_changed() directly is not an option as it needs open_mutex, which nbd_open() acquires under config_lock. Fixes: 267ec4d7223a ("loop: fix partition scan race between udev and loop_reread_partitions()") Cc: stable@vger.kernel.org Signed-off-by: Daan De Meyer --- drivers/block/nbd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 8f10762e90ef..cdafe9d39369 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1612,6 +1612,13 @@ static void nbd_clear_sock_ioctl(struct nbd_device *nbd) nbd_clear_sock(nbd); disk_force_media_change(nbd->disk); nbd_bdev_reset(nbd); + /* + * Drop the partitions of the disconnected device on the next open. They + * can exist even with max_part zero as they may have been added manually + * with BLKPG. Dropping them here is not possible as that needs + * open_mutex, which nbd_open() acquires under config_lock. + */ + set_bit(GD_NEED_PART_SCAN, &nbd->disk->state); if (test_and_clear_bit(NBD_RT_HAS_CONFIG_REF, &nbd->config->runtime_flags)) nbd_config_put(nbd); -- 2.54.0