jffs2 unmount with delayed work queued

jffs2 unmount with delayed work queued

[Scott Wood]

With slub debugging on, I was seeing a crash in timer code after
unmounting a jffs2 filesystem, with a reference to poisoned memory.  I
traced this back to jffs2_kill_sb() freeing the superblock with
c->wbuf_dwork.timer still active, and c->wbuf_queued = 1.  I've seen
this in Linus's current tree as well as 3.5.

I would have just sent a patch, but I wasn't sure exactly how to
gracefully shut things down -- cancel or flush, and at what point?
Don't want to do it too late for the work to happen safely, but don't
want to do it too early so that it could get queued again.

-Scott

Re: jffs2 unmount with delayed work queued

[Artem Bityutskiy]

[-- Attachment #1: Type: text/plain, Size: 939 bytes --]

On Wed, 2012-08-01 at 20:47 -0500, Scott Wood wrote:
> With slub debugging on, I was seeing a crash in timer code after
> unmounting a jffs2 filesystem, with a reference to poisoned memory.  I
> traced this back to jffs2_kill_sb() freeing the superblock with
> c->wbuf_dwork.timer still active, and c->wbuf_queued = 1.  I've seen
> this in Linus's current tree as well as 3.5.
> 
> I would have just sent a patch, but I wasn't sure exactly how to
> gracefully shut things down -- cancel or flush, and at what point?
> Don't want to do it too late for the work to happen safely, but don't
> want to do it too early so that it could get queued again.

Hi Scott,

sorry for slow reply. I have a fix in the l2-mtd tree for this, I think
dwmw2 will merge it upstream at some point:

http://git.infradead.org/users/dedekind/l2-mtd-2.6.git/commit/28b65f8a2eece7e14bd4b9359509c667a5cb07d1

-- 
Best Regards,
Artem Bityutskiy

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 836 bytes --]