Dmitry Vyukov wrote: > Here we go: Great. Thank you. > > [ 2853.033175] WARNING: wb_workfn: device is NULL > [ 2853.034709] wb->state=2 > It is surprising that wb->state == WB_shutting_down . WB_shutting_down is set by only wb_shutdown() and is always cleared before leaving wb_shutdown(). This means that someone was calling wb_shutdown() on this wb object. And bdi->dev == NULL means that bdi_unregister() already did bdi->dev = NULL while someone was still inside wb_shutdown(). Since we call wb_shutdown() from bdi_unregister() for each wb object on this bdi object, this should not happen. But since "INFO: task hung in wb_shutdown (2)" found that it is possible that wb_shutdown() is concurrently called on the same wb object, there might be something complicated concurrency. Well, is it really true that "we call wb_shutdown() from bdi_unregister() for each wb object on this bdi object"? It seems it is not always true... While cgwb_bdi_unregister() from bdi_unregister() calls wb_shutdown() on each wb object reachable from bdi->wb_list, wb_shutdown() firstly calls list_del_rcu(&wb->bdi_node) (which was added by list_add_tail_rcu(&wb->bdi_node, &bdi->wb_list) from cgwb_create()) and then starts waiting for that wb object by calling mod_delayed_work()/flush_delayed_work() and then clears WB_shutting_down. Then, it is possible that cgwb_bdi_unregister() from calls wb_shutdown() fails to find a wb object which already passed list_del_rcu() from wb_shutdown(), and cgwb_bdi_unregister() can return without waiting for somebody who is waiting inside wb_shutdown(). Hence, allows doing bdi->dev = NULL before a wb object which somebody is waiting inside wb_shutdown() completes wb_workfn(), and NULL pointer dereference...
