Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933635AbcJUJTx (ORCPT ); Fri, 21 Oct 2016 05:19:53 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:46920 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933608AbcJUJTq (ORCPT ); Fri, 21 Oct 2016 05:19:46 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marcelo Ricardo Leitner , David Teigland Subject: [PATCH 4.7 42/45] dlm: free workqueues after the connections Date: Fri, 21 Oct 2016 11:18:02 +0200 Message-Id: <20161021091429.478097896@linuxfoundation.org> X-Mailer: git-send-email 2.10.0 In-Reply-To: <20161021091427.214431885@linuxfoundation.org> References: <20161021091427.214431885@linuxfoundation.org> User-Agent: quilt/0.64 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1512 Lines: 51 4.7-stable review patch. If anyone has any objections, please let me know. ------------------ From: Marcelo Ricardo Leitner commit 3a8db79889ce16930aff19b818f5b09651bb7644 upstream. After backporting commit ee44b4bc054a ("dlm: use sctp 1-to-1 API") series to a kernel with an older workqueue which didn't use RCU yet, it was noticed that we are freeing the workqueues in dlm_lowcomms_stop() too early as free_conn() will try to access that memory for canceling the queued works if any. This issue was introduced by commit 0d737a8cfd83 as before it such attempt to cancel the queued works wasn't performed, so the issue was not present. This patch fixes it by simply inverting the free order. Fixes: 0d737a8cfd83 ("dlm: fix race while closing connections") Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: David Teigland Signed-off-by: Greg Kroah-Hartman --- fs/dlm/lowcomms.c | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) --- a/fs/dlm/lowcomms.c +++ b/fs/dlm/lowcomms.c @@ -1657,16 +1657,12 @@ void dlm_lowcomms_stop(void) mutex_lock(&connections_lock); dlm_allow_conn = 0; foreach_conn(stop_conn); + clean_writequeues(); + foreach_conn(free_conn); mutex_unlock(&connections_lock); work_stop(); - mutex_lock(&connections_lock); - clean_writequeues(); - - foreach_conn(free_conn); - - mutex_unlock(&connections_lock); kmem_cache_destroy(con_cache); }