Re: [PATCHv2] backing-dev: fix wakeup timer races with bdi_unregister()

[Rabin Vincent]

On Fri, Jan 20, 2012 at 05:16, Namjae Jeon <linkinjeon@xxxxxxxxx> wrote:
>>                bdi_debug_unregister(bdi);
>> -               device_unregister(bdi->dev);
>> +
>> +               spin_lock_bh(&bdi->wb_lock);
>>                bdi->dev = NULL;
>> +               spin_unlock_bh(&bdi->wb_lock);
> Hi.
> Would you explain me why you add spinlock in here ?

wakeup_timer_fn() does the following, where the
trace_writeback_wake_forker_thread() also accesses bdi->dev.
It does this under the wb_lock:

	} else if (bdi->dev) {
		/*
		 * When bdi tasks are inactive for long time, they are killed.
		 * In this case we have to wake-up the forker thread which
		 * should create and run the bdi thread.
		 */
		trace_writeback_wake_forker_thread(bdi);

If we don't have the lock above, the bdi->dev could potentially be
cleared after the check but before the tracepoint is hit, leading to a
NULL pointer dereference.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/