From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753914AbdFWIRH (ORCPT ); Fri, 23 Jun 2017 04:17:07 -0400 Received: from szxga02-in.huawei.com ([45.249.212.188]:8828 "EHLO szxga02-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751598AbdFWIRF (ORCPT ); Fri, 23 Jun 2017 04:17:05 -0400 Subject: Re: [PATCH] f2fs: fix ref of discard command To: Jaegeuk Kim , , , References: <20170612030449.79290-1-jaegeuk@kernel.org> From: Chao Yu Message-ID: Date: Fri, 23 Jun 2017 16:16:43 +0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.0 MIME-Version: 1.0 In-Reply-To: <20170612030449.79290-1-jaegeuk@kernel.org> Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.134.22.195] X-CFilter-Loop: Reflected X-Mirapoint-Virus-RAPID-Raw: score=unknown(0), refid=str=0001.0A0B0207.594CCE72.00AA,ss=1,re=0.000,recu=0.000,reip=0.000,cl=1,cld=1,fgs=0, ip=0.0.0.0, so=2014-11-16 11:51:01, dmn=2013-03-21 17:37:32 X-Mirapoint-Loop-Id: d47c3bf6e743f0647d5f0c0c72c187a2 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi Jaegeuk, On 2017/6/12 11:04, Jaegeuk Kim wrote: > This patch resolves kernel panic for xfstests/081, caused by recent f2fs_bug_on > > f2fs: add f2fs_bug_on in __remove_discard_cmd > > Signed-off-by: Jaegeuk Kim > --- > fs/f2fs/segment.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c > index 86a0c1095939..a6d77388a806 100644 > --- a/fs/f2fs/segment.c > +++ b/fs/f2fs/segment.c > @@ -1025,6 +1025,8 @@ static void __wait_discard_cmd(struct f2fs_sb_info *sbi, bool wait_cond) > list_for_each_entry_safe(dc, tmp, wait_list, list) { > if (!wait_cond || (dc->state == D_DONE && !dc->ref)) { > wait_for_completion_io(&dc->wait); > + if (dc->state == D_DONE && dc->ref) > + dc->ref--; How about using ("f2fs: stop discard thread in prior during umount") instead of this one? As dereference of dc here will lead use-after-free of real referrer. Thanks, > __remove_discard_cmd(sbi, dc); > } else { > dc->ref++; >