g_disk_done() vs a destroyed disk

[Andriy Gapon]

On 27/01/2017 23:55, Poul-Henning Kamp wrote:
> --------
> In message <cba9c9bf-97ad-e3ae-e209-ea91e49b5822 at FreeBSD.org>, Andriy Gapon writes:
>>
>> I've seen a situation where g_disk_done() was called on a bio after the
>> corresponding disk had been already destroyed via g_disk_destroy().
>> That call resulted in a crash here:
>> 	devstat_end_transaction_bio_bt(sc->dp->d_devstat, bp, &now);
>> because sc->dp was NULL.
>>
>> Is it a bug that we do not check for dp being NULL (or dp->d_destroyed being
>> set) in g_disk_done() ?
>> Or is it a bug that a controller driver called biodone() for that bio having

I should have said a disk driver here.

>> earlier called disk_destroy() ?
> 
> It is a driver bug to call disk_destroy() before purging all in-flight bios
> with biodone()

Oh, I didn't think of that.
So, the correct sequence should be:
- call disk_gone() to prevent new I/O
- handle all in-flight I/O
- call disk_destroy()
Is that right?

Thank you!
-- 
Andriy Gapon