complete_and_exit() problem

complete_and_exit() problem

[Jarkko Lavinen]

The garbage collection thread crashes when I unmount JFFS2. The filesystem
is empry and I only mount it and then unmount it. I am using kernel 
2.4.8ac12 with rmk1 patch for ARM cpu.

I traced the exeution to complete_and_exit(), then to complete(), then 
to __wake_up_common(). In __wake_up_common() there is a loop

        list_for_each(tmp,&q->task_list) {
                unsigned int state;
                wait_queue_t *curr = list_entry(tmp, wait_queue_t, task_list);

                CHECK_MAGIC(curr->__magic);
                p = curr->task;
                state = p->state;
                if (state & mode) {
                        WQ_NOTE_WAKER(curr);
                        if (try_to_wake_up(p, sync) && (curr->flags&WQ_FLAG_EXCL
USIVE) && !--nr_exclusive)
                                break;
                }
        }

When entering the loop, the list q->task_list contains no task.
q->task_list.next and q->task_lis.prev are null pointers. 
list_for_each() checks the end of list by comparing against the 
list head (q->task_list), not NULL.

I tried replacing 

-       if (comp)
+	if (comp && comp->wait.task_list.next)

in complete_and_exit(). I don't know if it is the right way to do it,
but at least the garbage gollection thread stopped crashing.

Jarkko Lavinen

Re: complete_and_exit() problem

[David Woodhouse]

jlavi@iki.fi said:
> The garbage collection thread crashes when I unmount JFFS2. The
> filesystem is empry and I only mount it and then unmount it. I am
> using kernel  2.4.8ac12 with rmk1 patch for ARM cpu.

> I traced the exeution to complete_and_exit(), then to complete(), then 
> to __wake_up_common(). In __wake_up_common() there is a loop

 <deletia - 
  http://lists.infradead.org/pipermail/linux-mtd/2001-September/003117.html >

> I tried replacing 
> -       if (comp) 
> +	if (comp && comp->wait.task_list.next)
> in complete_and_exit(). I don't know if it is the right way to do it,
> but at least the garbage gollection thread stopped crashing.

Looks like the list_head is uninitialised - we're in complete()
before anything's ever called init_completion().

ISTR this was the reason I bailed out on doing a quick fix for -ac before
disappearing to OLS.

--
dwmw2