+ writeback-cgroup-release-dying-cgwbs-by-switching-attached-inodes-fix.patch added to -mm tree

+ writeback-cgroup-release-dying-cgwbs-by-switching-attached-inodes-fix.patch added to -mm tree

[akpm]

The patch titled
     Subject: cgroup, writeback: add smp_mb() to inode_prepare_wbs_switch()
has been added to the -mm tree.  Its filename is
     writeback-cgroup-release-dying-cgwbs-by-switching-attached-inodes-fix.patch

This patch should soon appear at
    https://ozlabs.org/~akpm/mmots/broken-out/writeback-cgroup-release-dying-cgwbs-by-switching-attached-inodes-fix.patch
and later at
    https://ozlabs.org/~akpm/mmotm/broken-out/writeback-cgroup-release-dying-cgwbs-by-switching-attached-inodes-fix.patch

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated
there every 3-4 working days

------------------------------------------------------
From: Roman Gushchin <guro@fb.com>
Subject: cgroup, writeback: add smp_mb() to inode_prepare_wbs_switch()

Add a memory barrier between incrementing isw_nr_in_flight and checking
the sb's SB_ACTIVE flag and grabbing an inode in
inode_prepare_wbs_switch().  It's required to prevent grabbing an inode
before incrementing isw_nr_in_flight, otherwise 0 can be obtained as
isw_nr_in_flight in cgroup_writeback_umount() and isw_wq will not be
flushed, potentially leading to a memory corruption.

Added smp_mb() will work in pair with smp_mb() in
cgroup_writeback_umount().

Link: https://lkml.kernel.org/r/YMFa+guFw7OFjf3X@carbon.dhcp.thefacebook.com
Signed-off-by: Roman Gushchin <guro@fb.com>
Suggested-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/fs-writeback.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/fs/fs-writeback.c~writeback-cgroup-release-dying-cgwbs-by-switching-attached-inodes-fix
+++ a/fs/fs-writeback.c
@@ -512,6 +512,14 @@ static void inode_switch_wbs_work_fn(str
 static bool inode_prepare_wbs_switch(struct inode *inode,
 				     struct bdi_writeback *new_wb)
 {
+	/*
+	 * Paired with smp_mb() in cgroup_writeback_umount().
+	 * isw_nr_in_flight must be increased before checking SB_ACTIVE and
+	 * grabbing an inode, otherwise isw_nr_in_flight can be observed as 0
+	 * in cgroup_writeback_umount() and the isw_wq will be not flushed.
+	 */
+	smp_mb();
+
 	/* while holding I_WB_SWITCH, no one else can update the association */
 	spin_lock(&inode->i_lock);
 	if (!(inode->i_sb->s_flags & SB_ACTIVE) ||
_

Patches currently in -mm which might be from guro@fb.com are

writeback-cgroup-do-not-switch-inodes-with-i_will_free-flag.patch
writeback-cgroup-add-smp_mb-to-cgroup_writeback_umount.patch
writeback-cgroup-increment-isw_nr_in_flight-before-grabbing-an-inode.patch
writeback-cgroup-switch-to-rcu_work-api-in-inode_switch_wbs.patch
writeback-cgroup-keep-list-of-inodes-attached-to-bdi_writeback.patch
writeback-cgroup-split-out-the-functional-part-of-inode_switch_wbs_work_fn.patch
writeback-cgroup-support-switching-multiple-inodes-at-once.patch
writeback-cgroup-release-dying-cgwbs-by-switching-attached-inodes.patch
writeback-cgroup-release-dying-cgwbs-by-switching-attached-inodes-fix.patch