On Mon, 5 Oct 2015, Mike Snitzer wrote: > FYI, I've put rebased versions of your 2 patches in my wip branch, see: > http://git.kernel.org/cgit/linux/kernel/git/snitzer/linux.git/log/?h=wip I found a bug in the first patch (http://git.kernel.org/cgit/linux/kernel/git/snitzer/linux.git/commit/?h=wip&id=2e90df2e9cf482f45be4230152535fdab525fbd8) There is this piece of code: spin_lock(&bs->rescue_lock); bio_list_add(&bs->rescue_list, bio); spin_unlock(&bs->rescue_lock); queue_work(bs->rescue_workqueue, &bs->rescue_work); It is possible that after spin_unlock and before queue_work the bio is finished by previous workqueue invocation. When the bio is finished, it is possible that the block device is unloaded and queue_work accesses freed memory. Change the code so that queue_work is executed inside the spinlock: spin_lock(&bs->rescue_lock); bio_list_add(&bs->rescue_list, bio); queue_work(bs->rescue_workqueue, &bs->rescue_work); spin_unlock(&bs->rescue_lock); Mikulas -- dm-devel mailing list dm-devel@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/dm-devel
