From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id D84C2C3A5A1 for ; Thu, 22 Aug 2019 17:08:22 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id AE9EA23404 for ; Thu, 22 Aug 2019 17:08:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1566493702; bh=5ruvj0Kl7Jdtk416ercWYo2lT39P6j9MkmjDWCdDYv0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=LcgBkvLZeki2nOZFn0lGrm5o4xr1VOCSzhJQG/fXavHiO1SAzFnRfwkeTlEq5c5YF 3WIQEMPy0DH330KEEZM21SFJJn3SrhYFzsdQ+YOWXNj+XryCR6wSaas2H5nG5WZXHl t6mW5asa0BitXce7BgY6AelOt4u2buUuptAx1DRY= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390279AbfHVRIV (ORCPT ); Thu, 22 Aug 2019 13:08:21 -0400 Received: from mail.kernel.org ([198.145.29.99]:57750 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390254AbfHVRIT (ORCPT ); Thu, 22 Aug 2019 13:08:19 -0400 Received: from sasha-vm.mshome.net (wsip-184-188-36-2.sd.sd.cox.net [184.188.36.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9A8562341C; Thu, 22 Aug 2019 17:08:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1566493698; bh=5ruvj0Kl7Jdtk416ercWYo2lT39P6j9MkmjDWCdDYv0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KxyQr/4vd3vFm0b+a1nCpKZEKQAFPjuXxuMI0QPPmprYXF7GhGuzwc31ZBG6xMdbo oRfQajM5iyKILsdoXpHjfxd/jN1ejdGFW+x9bOMjqWHDNLeohdExGos2saa73ybabX d9vEgiu6+plGv71VwMDzpSCYhNHtdKqdzUMKUVV4= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Henry Burns , Shakeel Butt , Jonathan Adams , Vitaly Vul , Vitaly Wool , David Howells , Thomas Gleixner , Henry Burns , Andrew Morton , Linus Torvalds , Greg Kroah-Hartman Subject: [PATCH 5.2 007/135] mm/z3fold.c: fix z3fold_destroy_pool() ordering Date: Thu, 22 Aug 2019 13:06:03 -0400 Message-Id: <20190822170811.13303-8-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190822170811.13303-1-sashal@kernel.org> References: <20190822170811.13303-1-sashal@kernel.org> MIME-Version: 1.0 X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.2.10-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-5.2.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 5.2.10-rc1 X-KernelTest-Deadline: 2019-08-24T17:07+00:00 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Henry Burns commit 6051d3bd3b91e96c59e62b8be2dba1cc2b19ee40 upstream. The constraint from the zpool use of z3fold_destroy_pool() is there are no outstanding handles to memory (so no active allocations), but it is possible for there to be outstanding work on either of the two wqs in the pool. If there is work queued on pool->compact_workqueue when it is called, z3fold_destroy_pool() will do: z3fold_destroy_pool() destroy_workqueue(pool->release_wq) destroy_workqueue(pool->compact_wq) drain_workqueue(pool->compact_wq) do_compact_page(zhdr) kref_put(&zhdr->refcount) __release_z3fold_page(zhdr, ...) queue_work_on(pool->release_wq, &pool->work) *BOOM* So compact_wq needs to be destroyed before release_wq. Link: http://lkml.kernel.org/r/20190726224810.79660-1-henryburns@google.com Fixes: 5d03a6613957 ("mm/z3fold.c: use kref to prevent page free/compact race") Signed-off-by: Henry Burns Reviewed-by: Shakeel Butt Reviewed-by: Jonathan Adams Cc: Vitaly Vul Cc: Vitaly Wool Cc: David Howells Cc: Thomas Gleixner Cc: Al Viro Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/z3fold.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/mm/z3fold.c b/mm/z3fold.c index 3b27094dc42e1..d06d7f9560028 100644 --- a/mm/z3fold.c +++ b/mm/z3fold.c @@ -820,8 +820,15 @@ static void z3fold_destroy_pool(struct z3fold_pool *pool) { kmem_cache_destroy(pool->c_handle); z3fold_unregister_migration(pool); - destroy_workqueue(pool->release_wq); + + /* + * We need to destroy pool->compact_wq before pool->release_wq, + * as any pending work on pool->compact_wq will call + * queue_work(pool->release_wq, &pool->work). + */ + destroy_workqueue(pool->compact_wq); + destroy_workqueue(pool->release_wq); kfree(pool); } -- 2.20.1