From: Denis V. Lunev <[email protected]> The destructor never stops enospc_timer. ploop_presuspend() deletes it with timer_delete_sync_try(), which does not wait for a callback that runs on another CPU, and ploop_try_delay_enospc() tests wants_suspend without deferred_lock, so a write that fails with ENOSPC around the presuspend can arm the timer again. The callback dereferences the struct ploop that ploop_dtr() frees.
Shut the timer down at the start of ploop_destroy(), which waits for a running callback and keeps the timer from being armed again. The timer is set up before kt_worker is created, so it is valid wherever ploop_destroy() finds kt_worker set. https://virtuozzo.atlassian.net/browse/VSTOR-154182 Fixes: 6ddad5a4d226 ("dm-ploop: Add ploop target driver") Feature: dm-ploop: ploop target driver Signed-off-by: Denis V. Lunev <[email protected]> --- drivers/md/dm-ploop-target.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/md/dm-ploop-target.c b/drivers/md/dm-ploop-target.c index d8279c79ef56..5ab25cbd5c32 100644 --- a/drivers/md/dm-ploop-target.c +++ b/drivers/md/dm-ploop-target.c @@ -164,6 +164,7 @@ static void ploop_destroy(struct ploop *ploop) int i; if (ploop->kt_worker) { + timer_shutdown_sync(&ploop->enospc_timer); ploop->force_md_writeback = 1; wake_up_process(ploop->kt_worker->task); /* try to send all pending - if we have partial io and enospc end bellow */ -- 2.53.0 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
