backing-dev: fix wakeup timer races with bdi_unregister()
authorRabin Vincent <rabin@rab.in>
Sun, 29 Jan 2012 18:17:33 +0000 (12:17 -0600)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 20 Feb 2012 20:46:18 +0000 (12:46 -0800)
commit884d833e27faee8f929f95ca1be53b1997c66c30
treee4fcab399c71e061e6423baf740fd2dfbe6e7e6e
parent03b762ab87db7977a7e6d9fe92dd63fa6dbc5f02
backing-dev: fix wakeup timer races with bdi_unregister()

commit 2673b4cf5d59c3ee5e0c12f6d734d38770324dc4 upstream.

While 7a401a972df8e18 ("backing-dev: ensure wakeup_timer is deleted")
addressed the problem of the bdi being freed with a queued wakeup
timer, there are other races that could happen if the wakeup timer
expires after/during bdi_unregister(), before bdi_destroy() is called.

wakeup_timer_fn() could attempt to wakeup a task which has already has
been freed, or could access a NULL bdi->dev via the wake_forker_thread
tracepoint.

Cc: Jens Axboe <axboe@kernel.dk>
Reported-by: Chanho Min <chanho.min@lge.com>
Reviewed-by: Namjae Jeon <linkinjeon@gmail.com>
Signed-off-by: Rabin Vincent <rabin@rab.in>
Signed-off-by: Wu Fengguang <fengguang.wu@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
mm/backing-dev.c