BUG: 2.6.2-mm1: destroy_workqueue

BUG: 2.6.2-mm1: destroy_workqueue

[Matthias Urlichs]

I had a crash when unmounting a reiserfs at shutdown time.

Apparently, destroy_workqueue() inlines list_del(), which checks for

148             BUG_ON(entry->prev->next != entry);

This is a problem when entry->prev is NULL.  :-/

Call trace, copied off the screen by hand:
destroy_workqueue+0x30
do_journal_release+0x4e
journal_mark_dirty+0x18c
journal_release+0x10
reiserfs_put_super+0x24

Built using gcc version 3.3.2 (Debian), no other patches.

Re: BUG: 2.6.2-mm1: destroy_workqueue

[Andrew Morton]

Matthias Urlichs <smurf@smurf.noris.de> wrote:
>
> I had a crash when unmounting a reiserfs at shutdown time.
> 
> Apparently, destroy_workqueue() inlines list_del(), which checks for
> 
> 148             BUG_ON(entry->prev->next != entry);
> 
> This is a problem when entry->prev is NULL.  :-/
> 
> Call trace, copied off the screen by hand:
> destroy_workqueue+0x30
> do_journal_release+0x4e
> journal_mark_dirty+0x18c
> journal_release+0x10
> reiserfs_put_super+0x24
> 

yup, thanks.

--- 25/kernel/workqueue.c~cpuhotplug-03-core-workqueue-fix	Fri Feb  6 14:36:04 2004
+++ 25-akpm/kernel/workqueue.c	Fri Feb  6 14:36:41 2004
@@ -335,7 +335,7 @@ void destroy_workqueue(struct workqueue_
 		if (cpu_online(cpu))
 			cleanup_workqueue_thread(wq, cpu);
 	}
-	list_del(&wq->list);
+	del_workqueue(wq);
 	unlock_cpu_hotplug();
 	kfree(wq);
 }

_