bdi: avoid oops on device removal

After commit 839a8e8660b6 ("writeback: replace custom worker pool
implementation with unbound workqueue") when device is removed while we
are writing to it we crash in bdi_writeback_workfn() ->
set_worker_desc() because bdi->dev is NULL.

This can happen because even though bdi_unregister() cancels all pending
flushing work, nothing really prevents new ones from being queued from
balance_dirty_pages() or other places.

Fix the problem by clearing BDI_registered bit in bdi_unregister() and
checking it before scheduling of any flushing work.

Fixes: 839a8e8660b6777e7fe4e80af1a048aebe2b5977

Reviewed-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Cc: Derek Basehore <dbasehore@chromium.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 9 insertions, 4 deletions

diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index fab8401fc54e..09d9591b7708 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -297,7 +297,10 @@ void bdi_wakeup_thread_delayed(struct backing_dev_info *bdi)
         unsigned long timeout;
 
         timeout = msecs_to_jiffies(dirty_writeback_interval * 10);
-        queue_delayed_work(bdi_wq, &bdi->wb.dwork, timeout);
+        spin_lock_bh(&bdi->wb_lock);
+        if (test_bit(BDI_registered, &bdi->state))
+                queue_delayed_work(bdi_wq, &bdi->wb.dwork, timeout);
+        spin_unlock_bh(&bdi->wb_lock);
 }
 
 /*
@@ -310,9 +313,6 @@ static void bdi_remove_from_list(struct backing_dev_info *bdi)
         spin_unlock_bh(&bdi_lock);
 
         synchronize_rcu_expedited();
-
-        /* bdi_list is now unused, clear it to mark @bdi dying */
-        INIT_LIST_HEAD(&bdi->bdi_list);
 }
 
 int bdi_register(struct backing_dev_info *bdi, struct device *parent,
@@ -363,6 +363,11 @@ static void bdi_wb_shutdown(struct backing_dev_info *bdi)
          */
         bdi_remove_from_list(bdi);
 
+        /* Make sure nobody queues further work */
+        spin_lock_bh(&bdi->wb_lock);
+        clear_bit(BDI_registered, &bdi->state);
+        spin_unlock_bh(&bdi->wb_lock);
+
         /*
          * Drain work list and shutdown the delayed_work.  At this point,
          * @bdi->bdi_list is empty telling bdi_Writeback_workfn() that @bdi