[dm-devel] [PATCH] dm-thin: Fix race condition when destroying thin pool

[Nikolay Borisov]

When a thin pool is being destroyed delayed work items are
canceled using cancel_delayed_work item, which doesn't
guarantee that on return the delayed item wasn't running. This
can cause the workitem to requeue itself on an already destroyed
workqueue. Fix this by using cancel_delayed_work item which
guarantees that on return the workitem is not running anymore.

Fixes: 905e51b39a555 ("dm thin: commit outstanding data every second")
Fixes: 85ad643b7e7e52 ("dm thin: add timeout to stop out-of-data-space 
mode holding IO forever")
Signed-off-by: Nikolay Borisov <kernel at kyup.com>
Cc: <stable at vger.kernel.org>

---
 drivers/md/dm-thin.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 63903a5a5d9e..a1cc797fe88f 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -3453,8 +3453,8 @@ static void pool_postsuspend(struct dm_target *ti)
 	struct pool_c *pt = ti->private;
 	struct pool *pool = pt->pool;
 
-	cancel_delayed_work(&pool->waker);
-	cancel_delayed_work(&pool->no_space_timeout);
+	cancel_delayed_work_sync(&pool->waker);
+	cancel_delayed_work_sync(&pool->no_space_timeout);
 	flush_workqueue(pool->wq);
 	(void) commit(pool);
 }
-- 
2.5.0