mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 13:53:33 +00:00
dm cache: fix a crash due to incorrect work item cancelling
The crash can be reproduced by running the lvm2 testsuite test
lvconvert-thin-external-cache.sh for several minutes, e.g.:
while :; do make check T=shell/lvconvert-thin-external-cache.sh; done
The crash happens in this call chain:
do_waker -> policy_tick -> smq_tick -> end_hotspot_period -> clear_bitset
-> memset -> __memset -- which accesses an invalid pointer in the vmalloc
area.
The work entry on the workqueue is executed even after the bitmap was
freed. The problem is that cancel_delayed_work doesn't wait for the
running work item to finish, so the work item can continue running and
re-submitting itself even after cache_postsuspend. In order to make sure
that the work item won't be running, we must use cancel_delayed_work_sync.
Also, change flush_workqueue to drain_workqueue, so that if some work item
submits itself or another work item, we are properly waiting for both of
them.
Fixes: c6b4fcbad0
("dm: add cache target")
Cc: stable@vger.kernel.org # v3.9
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
This commit is contained in:
parent
7fc2e47f40
commit
7cdf6a0aae
1 changed files with 2 additions and 2 deletions
|
@ -2846,8 +2846,8 @@ static void cache_postsuspend(struct dm_target *ti)
|
|||
prevent_background_work(cache);
|
||||
BUG_ON(atomic_read(&cache->nr_io_migrations));
|
||||
|
||||
cancel_delayed_work(&cache->waker);
|
||||
flush_workqueue(cache->wq);
|
||||
cancel_delayed_work_sync(&cache->waker);
|
||||
drain_workqueue(cache->wq);
|
||||
WARN_ON(cache->tracker.in_flight);
|
||||
|
||||
/*
|
||||
|
|
Loading…
Reference in a new issue