Re: [PATCH] writeback: fix obtain a reference to a freeing memcg css

[Matthew Wilcox <willy@xxxxxxxxxxxxx>]

On Tue, Mar 30, 2021 at 05:29:33PM +0800, Muchun Song wrote:
> +++ b/fs/fs-writeback.c
> @@ -506,8 +506,10 @@ static void inode_switch_wbs(struct inode *inode, int new_wb_id)
>  	/* find and pin the new wb */
>  	rcu_read_lock();
>  	memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys);
> -	if (memcg_css)
> +	if (memcg_css && css_tryget(memcg_css)) {
>  		isw->new_wb = wb_get_create(bdi, memcg_css, GFP_ATOMIC);
> +		css_put(memcg_css);
> +	}
>  	rcu_read_unlock();
>  	if (!isw->new_wb)
>  		goto out_free;

This seems like an unnecessary use of GFP_ATOMIC.  Why not:

	rcu_read_lock();
	memcg_css = css_from_id(new_wb_id, &memory_cgrp_subsys);
	if (memcg_css && !css_tryget(memcg_css))
		memcg_css = NULL;
	rcu_read_unlock();
	if (!memcg_css)
		goto out_free;
	isw->new_wb = wb_get_create(bdi, memcg_css, GFP_NOIO);
	css_put(memcg_css);
	if (!isw->new_wb)
		goto out_free;

(inode_switch_wbs can't be called in interrupt context because it takes
inode->i_lock, which is not interrupt-safe.  it's not clear to me whether
it is allowed to start IO or do FS reclaim, given where it is in the
I/O path, so i went with GFP_NOIO rather than GFP_KERNEL)

(also there's another use of GFP_ATOMIC in that function, which is
probably wrong)