Applying with these fixes on my side:
- "Once the device is removed" became "Once the table is destroyed, on
device removal or table reload".
On Tue, 10 Nov 2026 20:00:32 +0100, Denis V. Lunev wrote:
> that fails with ENOSPC around the presuspend leaves the timer pending
> and the work queued after the suspend. Once the device is removed, the
> timer expires on the struct ploop that ploop_dtr() freed, and
> do_ploop_event_work() reads ploop->ti from it.
A table reload frees the old struct ploop the same way: do_resume()
suspends, swaps and then destroys the old table, so the race is there
too.
> if (ploop->kt_worker) {
> + timer_shutdown_sync(&ploop->enospc_timer);
> + cancel_work_sync(&ploop->event_work);
> ploop->force_md_writeback = 1;
The code is right. Sashiko's two remarks on it do not block it:
- Pios stranded on enospc_pios: cannot happen. A parked pio is a
request in flight, and dm calls ploop_dtr() only after all requests
are done: __dm_destroy() waits for md->holders, a reload waits in
dm_suspend(). Until then the timer is alive and, with patch 2,
resubmits the pio.
- event_work queued after the cancel: the only window left is in the
ENOSPC endio itself, between llist_add() and schedule_work(). Its own
mod_timer() and schedule_work() hit the freed struct there, so a
second cancel would not help. It is older than this patch; see the
separate-patch block in the cover letter reply.
--
Konstantin Khorenko,
Virtuozzo Linux Kernel Team
_______________________________________________
Devel mailing list
[email protected]
https://lists.openvz.org/mailman/listinfo/devel
