Matthew Wilcox <willy@infradead.org> 于2021年10月14日周四 下午7:26写道：

> On Thu, Oct 14, 2021 at 04:24:33PM +0800, Zqiang wrote:
> > The bdi_remove_from_list() is called in RCU softirq, however the
> > synchronize_rcu_expedited() will produce sleep action, use kfree_rcu()
> > instead of it.
> >
> > Reported-by: Hao Sun <sunhao.th@gmail.com>
> > Signed-off-by: Zqiang <qiang.zhang1211@gmail.com>
> > ---
> >  include/linux/backing-dev-defs.h | 1 +
> >  mm/backing-dev.c                 | 4 +---
> >  2 files changed, 2 insertions(+), 3 deletions(-)
> >
> > diff --git a/include/linux/backing-dev-defs.h
> b/include/linux/backing-dev-defs.h
> > index 33207004cfde..35a093384518 100644
> > --- a/include/linux/backing-dev-defs.h
> > +++ b/include/linux/backing-dev-defs.h
> > @@ -202,6 +202,7 @@ struct backing_dev_info {
> >  #ifdef CONFIG_DEBUG_FS
> >       struct dentry *debug_dir;
> >  #endif
> > +     struct rcu_head rcu;
> >  };
>
> >Instead of growing struct backing_dev_info, it seems to me this rcu_head
> >could be placed in a union with rb_node, since it will have been removed
> >from the bdi_tree by this point and the tree is never walked under
> >RCU protection?
>
>
Thanks for your advice, I find this bdi_tree is traversed under the
protection of a spin lock, not under the protection of RCU.
I find this modification does not avoid the problem described in patch,
the flush_delayed_work() may be called in release_bdi()
The same will cause problems.

may be  we can replace queue_rcu_work() of call_rcu(&inode->i_rcu,
i_callback) or do you have any better suggestions?

Thanks
Zqiang