bdi: avoid oops on device removal

After commit 839a8e8660b6 ("writeback: replace custom worker pool
implementation with unbound workqueue") when device is removed while we
are writing to it we crash in bdi_writeback_workfn() ->
set_worker_desc() because bdi->dev is NULL.

This can happen because even though bdi_unregister() cancels all pending
flushing work, nothing really prevents new ones from being queued from
balance_dirty_pages() or other places.

Fix the problem by clearing BDI_registered bit in bdi_unregister() and
checking it before scheduling of any flushing work.

Fixes: 839a8e8660b6777e7fe4e80af1a048aebe2b5977

Reviewed-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Jan Kara <jack@suse.cz>
Cc: Derek Basehore <dbasehore@chromium.org>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 18 insertions, 5 deletions

diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c
index 6788fe0c9761..a16315957ef3 100644
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -89,16 +89,29 @@ static inline struct inode *wb_inode(struct list_head *head)
 #define CREATE_TRACE_POINTS
 #include <trace/events/writeback.h>
 
+static void bdi_wakeup_thread(struct backing_dev_info *bdi)
+{
+        spin_lock_bh(&bdi->wb_lock);
+        if (test_bit(BDI_registered, &bdi->state))
+                mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0);
+        spin_unlock_bh(&bdi->wb_lock);
+}
+
 static void bdi_queue_work(struct backing_dev_info *bdi,
                            struct wb_writeback_work *work)
 {
         trace_writeback_queue(bdi, work);
 
         spin_lock_bh(&bdi->wb_lock);
+        if (!test_bit(BDI_registered, &bdi->state)) {
+                if (work->done)
+                        complete(work->done);
+                goto out_unlock;
+        }
         list_add_tail(&work->list, &bdi->work_list);
-        spin_unlock_bh(&bdi->wb_lock);
-
         mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0);
+out_unlock:
+        spin_unlock_bh(&bdi->wb_lock);
 }
 
 static void
@@ -114,7 +127,7 @@ __bdi_start_writeback(struct backing_dev_info *bdi, long nr_pages,
         work = kzalloc(sizeof(*work), GFP_ATOMIC);
         if (!work) {
                 trace_writeback_nowork(bdi);
-                mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0);
+                bdi_wakeup_thread(bdi);
                 return;
         }
 
@@ -161,7 +174,7 @@ void bdi_start_background_writeback(struct backing_dev_info *bdi)
          * writeback as soon as there is no other work to do.
          */
         trace_writeback_wake_background(bdi);
-        mod_delayed_work(bdi_wq, &bdi->wb.dwork, 0);
+        bdi_wakeup_thread(bdi);
 }
 
 /*
@@ -1017,7 +1030,7 @@ void bdi_writeback_workfn(struct work_struct *work)
         current->flags |= PF_SWAPWRITE;
 
         if (likely(!current_is_workqueue_rescuer() ||
-                   list_empty(&bdi->bdi_list))) {
+                   !test_bit(BDI_registered, &bdi->state))) {
                 /*
                  * The normal path.  Keep writing back @bdi until its
                  * work_list is empty.  Note that this path is also taken