jffs2 unmount with delayed work queued
With slub debugging on, I was seeing a crash in timer code after unmounting a jffs2 filesystem, with a reference to poisoned memory. I traced this back to jffs2_kill_sb() freeing the superblock with c->wbuf_dwork.timer still active, and c->wbuf_queued = 1. I've seen this in Linus's current tree as well as 3.5.
I would have just sent a patch, but I wasn't sure exactly how to gracefully shut things down -- cancel or flush, and at what point? Don't want to do it too late for the work to happen safely, but don't want to do it too early so that it could get queued again.
-Scott
Quoted 10 lines · Scott Wood
With slub debugging on, I was seeing a crash in timer code after unmounting a jffs2 filesystem, with a reference to poisoned memory. I traced this back to
jffs2_kill_sb()freeing the superblock withc->wbuf_dwork.timerstill active, andc->wbuf_queued= 1. I've seen this in Linus's current tree as well as 3.5.I would have just sent a patch, but I wasn't sure exactly how to gracefully shut things down -- cancel or flush, and at what point? Don't want to do it too late for the work to happen safely, but don't want to do it too early so that it could get queued again.
Hi Scott,
sorry for slow reply. I have a fix in the l2-mtd tree for this, I think dwmw2 will merge it upstream at some point:
Signature · 2 lines
Best Regards, Artem Bityutskiy