From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-10.1 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 826ABC3A5A3 for ; Thu, 22 Aug 2019 17:18:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 5823C233FE for ; Thu, 22 Aug 2019 17:18:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1566494292; bh=5ruvj0Kl7Jdtk416ercWYo2lT39P6j9MkmjDWCdDYv0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=2FYt296jP9kTp2rcbDeHStXRQ071fpExbxkhb1VzIQSPM8huoFw5LdQZpKcSrBGK4 7IzXOWoKv8Uu5ihzs237qH/UVHdc8OXQjJruYFkr3AWUfiJgl+XyAP18A/GMGRym3G 6nq0rdJY/AEZqX859lY27vtWVVWnFirrPTQqVWgo= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2390266AbfHVRIU (ORCPT ); Thu, 22 Aug 2019 13:08:20 -0400 Received: from mail.kernel.org ([198.145.29.99]:57750 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2390254AbfHVRIT (ORCPT ); Thu, 22 Aug 2019 13:08:19 -0400 Received: from sasha-vm.mshome.net (wsip-184-188-36-2.sd.sd.cox.net [184.188.36.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 9A8562341C; Thu, 22 Aug 2019 17:08:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1566493698; bh=5ruvj0Kl7Jdtk416ercWYo2lT39P6j9MkmjDWCdDYv0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KxyQr/4vd3vFm0b+a1nCpKZEKQAFPjuXxuMI0QPPmprYXF7GhGuzwc31ZBG6xMdbo oRfQajM5iyKILsdoXpHjfxd/jN1ejdGFW+x9bOMjqWHDNLeohdExGos2saa73ybabX d9vEgiu6+plGv71VwMDzpSCYhNHtdKqdzUMKUVV4= From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Henry Burns , Shakeel Butt , Jonathan Adams , Vitaly Vul , Vitaly Wool , David Howells , Thomas Gleixner , Henry Burns , Andrew Morton , Linus Torvalds , Greg Kroah-Hartman Subject: [PATCH 5.2 007/135] mm/z3fold.c: fix z3fold_destroy_pool() ordering Date: Thu, 22 Aug 2019 13:06:03 -0400 Message-Id: <20190822170811.13303-8-sashal@kernel.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20190822170811.13303-1-sashal@kernel.org> References: <20190822170811.13303-1-sashal@kernel.org> MIME-Version: 1.0 X-KernelTest-Patch: http://kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.2.10-rc1.gz X-KernelTest-Tree: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git X-KernelTest-Branch: linux-5.2.y X-KernelTest-Patches: git://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git X-KernelTest-Version: 5.2.10-rc1 X-KernelTest-Deadline: 2019-08-24T17:07+00:00 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Henry Burns commit 6051d3bd3b91e96c59e62b8be2dba1cc2b19ee40 upstream. The constraint from the zpool use of z3fold_destroy_pool() is there are no outstanding handles to memory (so no active allocations), but it is possible for there to be outstanding work on either of the two wqs in the pool. If there is work queued on pool->compact_workqueue when it is called, z3fold_destroy_pool() will do: z3fold_destroy_pool() destroy_workqueue(pool->release_wq) destroy_workqueue(pool->compact_wq) drain_workqueue(pool->compact_wq) do_compact_page(zhdr) kref_put(&zhdr->refcount) __release_z3fold_page(zhdr, ...) queue_work_on(pool->release_wq, &pool->work) *BOOM* So compact_wq needs to be destroyed before release_wq. Link: http://lkml.kernel.org/r/20190726224810.79660-1-henryburns@google.com Fixes: 5d03a6613957 ("mm/z3fold.c: use kref to prevent page free/compact race") Signed-off-by: Henry Burns Reviewed-by: Shakeel Butt Reviewed-by: Jonathan Adams Cc: Vitaly Vul Cc: Vitaly Wool Cc: David Howells Cc: Thomas Gleixner Cc: Al Viro Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- mm/z3fold.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/mm/z3fold.c b/mm/z3fold.c index 3b27094dc42e1..d06d7f9560028 100644 --- a/mm/z3fold.c +++ b/mm/z3fold.c @@ -820,8 +820,15 @@ static void z3fold_destroy_pool(struct z3fold_pool *pool) { kmem_cache_destroy(pool->c_handle); z3fold_unregister_migration(pool); - destroy_workqueue(pool->release_wq); + + /* + * We need to destroy pool->compact_wq before pool->release_wq, + * as any pending work on pool->compact_wq will call + * queue_work(pool->release_wq, &pool->work). + */ + destroy_workqueue(pool->compact_wq); + destroy_workqueue(pool->release_wq); kfree(pool); } -- 2.20.1