From: Denis V. Lunev <[email protected]> The destructor never stops enospc_timer or event_work. ploop_try_delay_enospc() arms the timer and queues the work after testing wants_suspend, and nothing orders that against timer_delete_sync_try() and flush_work() in ploop_presuspend(). A write that fails with ENOSPC around the presuspend leaves the timer pending and the work queued after the suspend. Once the device is removed, the timer expires on the struct ploop that ploop_dtr() freed, and do_ploop_event_work() reads ploop->ti from it.
Shut the timer down and cancel the work at the start of ploop_destroy(). Both are set up before kt_worker is created, so they are valid wherever ploop_destroy() finds kt_worker set. https://virtuozzo.atlassian.net/browse/VSTOR-154182 Fixes: 6ddad5a4d226 ("dm-ploop: Add ploop target driver") Feature: dm-ploop: ploop target driver Signed-off-by: Denis V. Lunev <[email protected]> --- drivers/md/dm-ploop-target.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/md/dm-ploop-target.c b/drivers/md/dm-ploop-target.c index d8279c79ef56..54b25fd0cb22 100644 --- a/drivers/md/dm-ploop-target.c +++ b/drivers/md/dm-ploop-target.c @@ -164,6 +164,8 @@ static void ploop_destroy(struct ploop *ploop) int i; if (ploop->kt_worker) { + timer_shutdown_sync(&ploop->enospc_timer); + cancel_work_sync(&ploop->event_work); ploop->force_md_writeback = 1; wake_up_process(ploop->kt_worker->task); /* try to send all pending - if we have partial io and enospc end bellow */ -- 2.53.0 _______________________________________________ Devel mailing list [email protected] https://lists.openvz.org/mailman/listinfo/devel
