[PATCH] dm snapshot: fix kcopyd destructor

Before removing a snapshot, wait for the completion of any kcopyd jobs using
it.

Do this by maintaining a count (nr_jobs) of how many outstanding jobs each
kcopyd_client has.

The snapshot destructor first unregisters the snapshot so that no new kcopyd
jobs (created by writes to the origin) will reference that particular
snapshot.  kcopyd_client_destroy() is now run next to wait for the completion
of any outstanding jobs before the snapshot exception structures (that those
jobs reference) are freed.

Signed-off-by: Alasdair G Kergon <agk@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>

2 files changed, 21 insertions, 2 deletions

diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index a5765f9fbe02..08312b46463a 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -559,8 +559,12 @@ static void snapshot_dtr(struct dm_target *ti)
 {
         struct dm_snapshot *s = (struct dm_snapshot *) ti->private;
 
+        /* Prevent further origin writes from using this snapshot. */
+        /* After this returns there can be no new kcopyd jobs. */
         unregister_snapshot(s);
 
+        kcopyd_client_destroy(s->kcopyd_client);
+
         exit_exception_table(&s->pending, pending_cache);
         exit_exception_table(&s->complete, exception_cache);
 
@@ -569,7 +573,7 @@ static void snapshot_dtr(struct dm_target *ti)
 
         dm_put_device(ti, s->origin);
         dm_put_device(ti, s->cow);
-        kcopyd_client_destroy(s->kcopyd_client);
+
         kfree(s);
 }
 
diff --git a/drivers/md/kcopyd.c b/drivers/md/kcopyd.c
index 9dcb2c8a3853..ed71f3f94620 100644
--- a/drivers/md/kcopyd.c
+++ b/drivers/md/kcopyd.c
@@ -44,6 +44,9 @@ struct kcopyd_client {
         struct page_list *pages;
         unsigned int nr_pages;
         unsigned int nr_free_pages;
+
+        wait_queue_head_t destroyq;
+        atomic_t nr_jobs;
 };
 
 static struct page_list *alloc_pl(void)
@@ -292,10 +295,15 @@ static int run_complete_job(struct kcopyd_job *job)
         int read_err = job->read_err;
         unsigned int write_err = job->write_err;
         kcopyd_notify_fn fn = job->fn;
+        struct kcopyd_client *kc = job->kc;
 
-        kcopyd_put_pages(job->kc, job->pages);
+        kcopyd_put_pages(kc, job->pages);
         mempool_free(job, _job_pool);
         fn(read_err, write_err, context);
+
+        if (atomic_dec_and_test(&kc->nr_jobs))
+                wake_up(&kc->destroyq);
+
         return 0;
 }
 
@@ -430,6 +438,7 @@ static void do_work(void *ignored)
  */
 static void dispatch_job(struct kcopyd_job *job)
 {
+        atomic_inc(&job->kc->nr_jobs);
         push(&_pages_jobs, job);
         wake();
 }
@@ -669,6 +678,9 @@ int kcopyd_client_create(unsigned int nr_pages, struct kcopyd_client **result)
                 return r;
         }
 
+        init_waitqueue_head(&kc->destroyq);
+        atomic_set(&kc->nr_jobs, 0);
+
         client_add(kc);
         *result = kc;
         return 0;
@@ -676,6 +688,9 @@ int kcopyd_client_create(unsigned int nr_pages, struct kcopyd_client **result)
 
 void kcopyd_client_destroy(struct kcopyd_client *kc)
 {
+        /* Wait for completion of all jobs submitted by this client. */
+        wait_event(kc->destroyq, !atomic_read(&kc->nr_jobs));
+
         dm_io_put(kc->nr_pages);
         client_free_pages(kc);
         client_del(kc);