github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-21 13:27:57 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

cgroup: fix umount vs cgroup_event_remove() race

Browse Source 
commit 1c8158eeae upstream.

 commit 5db9a4d99b
 Author: Tejun Heo <tj@kernel.org>
 Date:   Sat Jul 7 16:08:18 2012 -0700

     cgroup: fix cgroup hierarchy umount race

This commit fixed a race caused by the dput() in css_dput_fn(), but
the dput() in cgroup_event_remove() can also lead to the same BUG().

Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Li Zefan 2013-06-18 18:41:10 +08:00 committed by Greg Kroah-Hartman
parent 5eb2698932
commit 83d0eb7975
1 changed files with 19 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
kernel/cgroup.c
View File

@ -3726,6 +3726,23 @@ static int cgroup_write_notify_on_release(struct cgroup *cgrp,
return 0;
}
/*
* When dput() is called asynchronously, if umount has been done and
* then deactivate_super() in cgroup_free_fn() kills the superblock,
* there's a small window that vfs will see the root dentry with non-zero
* refcnt and trigger BUG().
*
* That's why we hold a reference before dput() and drop it right after.
*/
static void cgroup_dput(struct cgroup *cgrp)
{
struct super_block *sb = cgrp->root->sb;
atomic_inc(&sb->s_active);
dput(cgrp->dentry);
deactivate_super(sb);
}
/*
* Unregister event and free resources.
*
@ -3746,7 +3763,7 @@ static void cgroup_event_remove(struct work_struct *work)
eventfd_ctx_put(event->eventfd);
kfree(event);
dput(cgrp->dentry);
cgroup_dput(cgrp);
}
/*
@ -4031,12 +4048,8 @@ static void css_dput_fn(struct work_struct *work)
{
struct cgroup_subsys_state *css =
container_of(work, struct cgroup_subsys_state, dput_work);
struct dentry *dentry = css->cgroup->dentry;
struct super_block *sb = dentry->d_sb;
atomic_inc(&sb->s_active);
dput(dentry);
deactivate_super(sb);
cgroup_dput(css->cgroup);
}
static void init_cgroup_css(struct cgroup_subsys_state *css,