Messages in this thread | | | Subject | Re: general protection fault in wb_workfn (2) | From | Tetsuo Handa <> | Date | Sat, 9 Jun 2018 14:30:41 +0900 |
| |
Dmitry Vyukov wrote: > Here we go:
Great. Thank you.
> > [ 2853.033175] WARNING: wb_workfn: device is NULL > [ 2853.034709] wb->state=2 >
It is surprising that wb->state == WB_shutting_down .
WB_shutting_down is set by only wb_shutdown() and is always cleared before leaving wb_shutdown(). This means that someone was calling wb_shutdown() on this wb object. And bdi->dev == NULL means that bdi_unregister() already did bdi->dev = NULL while someone was still inside wb_shutdown().
Since we call wb_shutdown() from bdi_unregister() for each wb object on this bdi object, this should not happen. But since "INFO: task hung in wb_shutdown (2)" found that it is possible that wb_shutdown() is concurrently called on the same wb object, there might be something complicated concurrency.
Well, is it really true that "we call wb_shutdown() from bdi_unregister() for each wb object on this bdi object"? It seems it is not always true...
While cgwb_bdi_unregister() from bdi_unregister() calls wb_shutdown() on each wb object reachable from bdi->wb_list, wb_shutdown() firstly calls list_del_rcu(&wb->bdi_node) (which was added by list_add_tail_rcu(&wb->bdi_node, &bdi->wb_list) from cgwb_create()) and then starts waiting for that wb object by calling mod_delayed_work()/flush_delayed_work() and then clears WB_shutting_down.
Then, it is possible that cgwb_bdi_unregister() from calls wb_shutdown() fails to find a wb object which already passed list_del_rcu() from wb_shutdown(), and cgwb_bdi_unregister() can return without waiting for somebody who is waiting inside wb_shutdown(). Hence, allows doing bdi->dev = NULL before a wb object which somebody is waiting inside wb_shutdown() completes wb_workfn(), and NULL pointer dereference...
| |