From patchwork Thu Feb 18 17:44:27 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tejun Heo X-Patchwork-Id: 584854 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id A65E114033E for ; Fri, 19 Feb 2016 04:44:52 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.b=M6rzcgfc; dkim-atps=neutral Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1423563AbcBRRod (ORCPT ); Thu, 18 Feb 2016 12:44:33 -0500 Received: from mail-yw0-f182.google.com ([209.85.161.182]:36089 "EHLO mail-yw0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756473AbcBRRoa (ORCPT ); Thu, 18 Feb 2016 12:44:30 -0500 Received: by mail-yw0-f182.google.com with SMTP id e63so46482404ywc.3; Thu, 18 Feb 2016 09:44:30 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:date:from:to:cc:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=W1sP1XB+hZyDjFZIx1LSbax6nS06IfceyxVmH6Hfx8E=; b=M6rzcgfcXuP+WU0RfjK8ZWRauKgSdesAcq7e7/2ect7WEVe0vFq8Z9vIwfIvQbPQGO jmAO5DTT76J0mMvEuGsiCwjgsXYywudeD0zts/dPi4ccUwPiZsOZNU466qYQzIi57R9c BOpTrqEFiNEztLxNigz3Fq8XsipNpap9cSayFvvhpMDD+qvF6PPKO36bxxy1qg79WsSP H0KQ1oWygmlp0iMt28oCY6fQKC8wDMFvrmy7bGvmGsb7vUqR3hiPzAf8yhVrJOFktjrm pOyKS9qblaEz6PMvgTUmuMu6gLLb0fdY6BEznEGUbWggfVPI9q/Cw+8N5y3qdDf7dRQY qfYg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:sender:date:from:to:cc:subject:message-id :references:mime-version:content-type:content-disposition :in-reply-to:user-agent; bh=W1sP1XB+hZyDjFZIx1LSbax6nS06IfceyxVmH6Hfx8E=; b=E4S+L4r8Jq59wyw75p7j4dqFFYn7K18zwlsLFu2d8FhElsoRp+wBAnRz0EXvkn7ZSK 421pRO77Zlc9gp9I8NnBixieuqIenB/sdCyzFeI1tiawP+MLqTXKxm+bi3eqNyoUGMT6 qIoUNg2AvaAtPbOlG6zP05yd9NBGg2hDtf0yZUKa8oTCcm9RtEEe2a7Q+A9jt4KSxU+A pKy+JnN+NIDERG4A767lFVjPLFooYedmfmrdli3pT2QGLWwmQkDHUoFh/WeEBy27sjkN jWr6OcC4vvZ9HdjsQUWTei484HzY0u7kAWVwwAjVH4sRw2Ty11+YJe1VoPWKk7EE3cyL i9jA== X-Gm-Message-State: AG10YOQDgx8z901nQTtALlxvi+sCiYMyaI67ClgBbPmSkg0XHkSUH5LDRpttDrO9oLHsdw== X-Received: by 10.129.57.135 with SMTP id g129mr4944644ywa.244.1455817470188; Thu, 18 Feb 2016 09:44:30 -0800 (PST) Received: from localhost ([2620:10d:c091:200::b:71de]) by smtp.gmail.com with ESMTPSA id a65sm5353817ywg.38.2016.02.18.09.44.28 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Thu, 18 Feb 2016 09:44:28 -0800 (PST) Date: Thu, 18 Feb 2016 12:44:27 -0500 From: Tejun Heo To: Dmitry Vyukov Cc: Jiri Slaby , Marcel Holtmann , Gustavo Padovan , Johan Hedberg , "David S. Miller" , linux-bluetooth@vger.kernel.org, netdev , LKML , syzkaller , Kostya Serebryany , Alexander Potapenko , Sasha Levin , Eric Dumazet , Takashi Iwai Subject: Re: net/bluetooth: workqueue destruction WARNING in hci_unregister_dev Message-ID: <20160218174427.GG13177@mtj.duckdns.org> References: <56C5CE85.6090808@suse.cz> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.24 (2015-08-30) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Hello, Can you please do the followings? 1. Remove WQ_MEM_RECLAIM from the affected workqueue and see whether the problem is reproducible. WQ_MEM_RECLAIM on anything bluetooth doesn't make sense btw. Why is it there? 2. If WQ_MEM_RECLAIM makes the issue go away, see whether the attached patch works too. Thanks. diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 7ff5dc7..9824d4f 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -4012,7 +4012,7 @@ void destroy_workqueue(struct workqueue_struct *wq) /* drain it before proceeding with destruction */ drain_workqueue(wq); - /* sanity checks */ + /* nothing should be in flight */ mutex_lock(&wq->mutex); for_each_pwq(pwq, wq) { int i; @@ -4024,8 +4024,7 @@ void destroy_workqueue(struct workqueue_struct *wq) } } - if (WARN_ON((pwq != wq->dfl_pwq) && (pwq->refcnt > 1)) || - WARN_ON(pwq->nr_active) || + if (WARN_ON(pwq->nr_active) || WARN_ON(!list_empty(&pwq->delayed_works))) { mutex_unlock(&wq->mutex); return; @@ -4046,6 +4045,13 @@ void destroy_workqueue(struct workqueue_struct *wq) if (wq->rescuer) kthread_stop(wq->rescuer->task); + /* rescuer is gone, everything should be quiescent now */ + WARN_ON(!list_empty(&wq->maydays)); + mutex_lock(&wq->mutex); + for_each_pwq(pwq, wq) + WARN_ON((pwq != wq->dfl_pwq) && (pwq->refcnt > 1)); + mutex_unlock(&wq->mutex); + if (!(wq->flags & WQ_UNBOUND)) { /* * The base ref is never dropped on per-cpu pwqs. Directly