lkml.org 
[lkml]   [2013]   [Sep]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[153/251] cgroup: fix umount vs cgroup_cfts_commit() race
    3.6.11.9-rc1 stable review patch.
    If anyone has any objections, please let me know.

    ------------------

    From: Li Zefan <lizefan@huawei.com>

    [ Upstream commit 084457f284abf6789d90509ee11dae383842b23b ]

    cgroup_cfts_commit() uses dget() to keep cgroup alive after cgroup_mutex
    is dropped, but dget() won't prevent cgroupfs from being umounted. When
    the race happens, vfs will see some dentries with non-zero refcnt while
    umount is in process.

    Keep running this:
    mount -t cgroup -o blkio xxx /cgroup
    umount /cgroup

    And this:
    modprobe cfq-iosched
    rmmod cfs-iosched

    After a while, the BUG() in shrink_dcache_for_umount_subtree() may
    be triggered:

    BUG: Dentry xxx{i=0,n=blkio.yyy} still in use (1) [umount of cgroup cgroup]

    Signed-off-by: Li Zefan <lizefan@huawei.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
    ---
    kernel/cgroup.c | 9 ++++++++-
    1 file changed, 8 insertions(+), 1 deletion(-)

    diff --git a/kernel/cgroup.c b/kernel/cgroup.c
    index 9cf9102..79e528f 100644
    --- a/kernel/cgroup.c
    +++ b/kernel/cgroup.c
    @@ -2761,13 +2761,17 @@ static void cgroup_cfts_commit(struct cgroup_subsys *ss,
    {
    LIST_HEAD(pending);
    struct cgroup *cgrp, *n;
    + struct super_block *sb = ss->root->sb;

    /* %NULL @cfts indicates abort and don't bother if @ss isn't attached */
    - if (cfts && ss->root != &rootnode) {
    + if (cfts && ss->root != &rootnode &&
    + atomic_inc_not_zero(&sb->s_active)) {
    list_for_each_entry(cgrp, &ss->root->allcg_list, allcg_node) {
    dget(cgrp->dentry);
    list_add_tail(&cgrp->cft_q_node, &pending);
    }
    + } else {
    + sb = NULL;
    }

    mutex_unlock(&cgroup_mutex);
    @@ -2790,6 +2794,9 @@ static void cgroup_cfts_commit(struct cgroup_subsys *ss,
    dput(cgrp->dentry);
    }

    + if (sb)
    + deactivate_super(sb);
    +
    mutex_unlock(&cgroup_cft_mutex);
    }

    --
    1.7.10.4



    \
     
     \ /
      Last update: 2013-09-11 08:41    [W:4.262 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site