On Thu, Mar 10, 2022 at 12:53:01PM +0100, Valentin Kleibel wrote:

There is a bug in the aoe driver module where every forcible removal of an
aoe device (eg. "rmmod aoe" with aoe devices available or "aoe-flush ex.x")
leads to a page fault.
The code in freedev() calls blk_mq_free_tag_set() before running
blk_cleanup_queue() which leads to this issue (drivers/block/aoe/aoedev.c
L281ff).
This issue was fixed upstream in commit 6560ec9 (aoe: use blk_mq_alloc_disk
and blk_cleanup_disk) with the introduction and use of the function
blk_cleanup_disk().

This patch applies to kernels 5.4 and 5.10.

We need a fix for Linus's tree first before we can backport anything to
older kernels.  Does this also work there?

The function calls are reordered to match the behavior of blk_cleanup_disk()
to mitigate this issue.

Fixes: 3582dd2 (aoe: convert aoeblk to blk-mq)

A few more digits in the sha1 here would be good, otherwise our tools
will complain.  It should look like:
Fixes: 3582dd291788 ("aoe: convert aoeblk to blk-mq")

thanks,

greg k-h