dm cache: fix a crash due to incorrect work item cancelling
commit5.4-rM2-2.2.x-imx-squashed7cdf6a0aae
upstream. The crash can be reproduced by running the lvm2 testsuite test lvconvert-thin-external-cache.sh for several minutes, e.g.: while :; do make check T=shell/lvconvert-thin-external-cache.sh; done The crash happens in this call chain: do_waker -> policy_tick -> smq_tick -> end_hotspot_period -> clear_bitset -> memset -> __memset -- which accesses an invalid pointer in the vmalloc area. The work entry on the workqueue is executed even after the bitmap was freed. The problem is that cancel_delayed_work doesn't wait for the running work item to finish, so the work item can continue running and re-submitting itself even after cache_postsuspend. In order to make sure that the work item won't be running, we must use cancel_delayed_work_sync. Also, change flush_workqueue to drain_workqueue, so that if some work item submits itself or another work item, we are properly waiting for both of them. Fixes:c6b4fcbad0
("dm: add cache target") Cc: stable@vger.kernel.org # v3.9 Signed-off-by: Mikulas Patocka <mpatocka@redhat.com> Signed-off-by: Mike Snitzer <snitzer@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
a7ab1264e8
commit
e600edc7d8
|
@ -2867,8 +2867,8 @@ static void cache_postsuspend(struct dm_target *ti)
|
||||||
prevent_background_work(cache);
|
prevent_background_work(cache);
|
||||||
BUG_ON(atomic_read(&cache->nr_io_migrations));
|
BUG_ON(atomic_read(&cache->nr_io_migrations));
|
||||||
|
|
||||||
cancel_delayed_work(&cache->waker);
|
cancel_delayed_work_sync(&cache->waker);
|
||||||
flush_workqueue(cache->wq);
|
drain_workqueue(cache->wq);
|
||||||
WARN_ON(cache->tracker.in_flight);
|
WARN_ON(cache->tracker.in_flight);
|
||||||
|
|
||||||
/*
|
/*
|
||||||
|
|
Loading…
Reference in New Issue