Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2673b4cf authored by Rabin Vincent's avatar Rabin Vincent Committed by Wu Fengguang
Browse files

backing-dev: fix wakeup timer races with bdi_unregister() 



While 7a401a97 ("backing-dev: ensure wakeup_timer is deleted")
addressed the problem of the bdi being freed with a queued wakeup
timer, there are other races that could happen if the wakeup timer
expires after/during bdi_unregister(), before bdi_destroy() is called.

wakeup_timer_fn() could attempt to wakeup a task which has already has
been freed, or could access a NULL bdi->dev via the wake_forker_thread
tracepoint.

Cc: <stable@kernel.org>
Cc: Jens Axboe <axboe@kernel.dk>
Reported-by: default avatarChanho Min <chanho.min@lge.com>
Reviewed-by: default avatarNamjae Jeon <linkinjeon@gmail.com>
Signed-off-by: default avatarRabin Vincent <rabin@rab.in>
Signed-off-by: default avatarWu Fengguang <fengguang.wu@intel.com>
parent 62aa2b53

mm/backing-dev.c

+18 −5
Original line number Diff line number Diff line
@@ -318,7 +318,7 @@ static void wakeup_timer_fn(unsigned long data) 
	if (bdi->wb.task) {

		trace_writeback_wake_thread(bdi);

		wake_up_process(bdi->wb.task);

	} else {

	} else if (bdi->dev) {

		/*

		 * When bdi tasks are inactive for long time, they are killed.

		 * In this case we have to wake-up the forker thread which
@@ -584,6 +584,8 @@ EXPORT_SYMBOL(bdi_register_dev); 
 */

static void bdi_wb_shutdown(struct backing_dev_info *bdi)

{

	struct task_struct *task;



	if (!bdi_cap_writeback_dirty(bdi))

		return;
@@ -602,8 +604,13 @@ static void bdi_wb_shutdown(struct backing_dev_info *bdi) 
	 * Finally, kill the kernel thread. We don't need to be RCU

	 * safe anymore, since the bdi is gone from visibility.

	 */

	if (bdi->wb.task)

		kthread_stop(bdi->wb.task);

	spin_lock_bh(&bdi->wb_lock);

	task = bdi->wb.task;

	bdi->wb.task = NULL;

	spin_unlock_bh(&bdi->wb_lock);



	if (task)

		kthread_stop(task);

}



/*
@@ -623,7 +630,9 @@ static void bdi_prune_sb(struct backing_dev_info *bdi) 


void bdi_unregister(struct backing_dev_info *bdi)

{

	if (bdi->dev) {

	struct device *dev = bdi->dev;



	if (dev) {

		bdi_set_min_ratio(bdi, 0);

		trace_writeback_bdi_unregister(bdi);

		bdi_prune_sb(bdi);
@@ -632,8 +641,12 @@ void bdi_unregister(struct backing_dev_info *bdi) 
		if (!bdi_cap_flush_forker(bdi))

			bdi_wb_shutdown(bdi);

		bdi_debug_unregister(bdi);

		device_unregister(bdi->dev);



		spin_lock_bh(&bdi->wb_lock);

		bdi->dev = NULL;

		spin_unlock_bh(&bdi->wb_lock);



		device_unregister(dev);

	}

}

EXPORT_SYMBOL(bdi_unregister);