[Devel] [PATCH hci-8.1 1/2] dm-ploop: stop enospc_timer in ploop_destroy()

[Denis V. Lunev]

From: Denis V. Lunev <den at openvz.org>

The destructor never stops enospc_timer. ploop_presuspend() deletes it
with timer_delete_sync_try(), which does not wait for a callback that
runs on another CPU, and ploop_try_delay_enospc() tests wants_suspend
without deferred_lock, so a write that fails with ENOSPC around the
presuspend can arm the timer again. The callback dereferences the
struct ploop that ploop_dtr() frees.

Shut the timer down at the start of ploop_destroy(), which waits for a
running callback and keeps the timer from being armed again. The timer
is set up before kt_worker is created, so it is valid wherever
ploop_destroy() finds kt_worker set.

https://virtuozzo.atlassian.net/browse/VSTOR-154182

Fixes: 6ddad5a4d226 ("dm-ploop: Add ploop target driver")
Feature: dm-ploop: ploop target driver
Signed-off-by: Denis V. Lunev <den at openvz.org>
---
 drivers/md/dm-ploop-target.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/md/dm-ploop-target.c b/drivers/md/dm-ploop-target.c
index d8279c79ef56..5ab25cbd5c32 100644
--- a/drivers/md/dm-ploop-target.c
+++ b/drivers/md/dm-ploop-target.c
@@ -164,6 +164,7 @@ static void ploop_destroy(struct ploop *ploop)
 	int i;
 
 	if (ploop->kt_worker) {
+		timer_shutdown_sync(&ploop->enospc_timer);
 		ploop->force_md_writeback = 1;
 		wake_up_process(ploop->kt_worker->task);
 		/* try to send all pending - if we have partial io and enospc end bellow */
-- 
2.53.0