Al Viro wrote:
> On Tue, Feb 10, 2009 at 11:06:39AM +0800, Li Zefan wrote:
>
>> BTW, I found another bug in current code:
>
> Why is that a bug? If _anything_ had been trying to acquire the
> rwsem in question, it would be fscked anyway. Not to mention
> that nothing could have ever seen that struct super_block in this
> particular case, as a general rule
> * if something might be blocked on your mutex/rwsem or spinning
> on a spinlock, releasing it before you free the object won't save your
> arse.
> You have no promise whatsoever that whoever's been trying to
> get the lock in question will even get out of the locking primitive
> before the memory that contains the lock gets freed. In case of superblocks
> in general, you don't free them until ->s_count hits zero. At that point
> anything as much as remembering the address of that superblock is already
> FUBAR.
>
This is not the general case. This sb won't be seen by anyone, and destroy_super()
is called on a sb with ->s_count == 1 and ->s_umount held.
Actually I ran into this after Peter's patch applied:
=========================
[ BUG: held lock freed! ]
-------------------------
mount/13413 is freeing memory e767a800-e767abff, with a lock still held there!
(&type->s_umount_key#29/1){--..}, at: [<c04a4104>] sget+0x1ea/0x324
2 locks held by mount/13413:
#0: (&type->s_umount_key#29/1){--..}, at: [<c04a4104>] sget+0x1ea/0x324
#1: (&type->s_umount_key#30){--..}, at: [<c04a3f72>] sget+0x58/0x324
stack backtrace:
Pid: 13413, comm: mount Not tainted 2.6.29-rc4 #548
Call Trace:
[<c044d865>] debug_check_no_locks_freed+0xc9/0x105
[<c049c86d>] kfree+0x82/0xd1
[<c04a41e0>] ? sget+0x2c6/0x324
[<c04a41e0>] sget+0x2c6/0x324
[<c045dda9>] ? cgroup_set_super+0x0/0x3e
[<c045cf6f>] ? cgroup_test_super+0x0/0x2f
[<c045f840>] cgroup_get_sb+0x8d/0x284
[<c0489216>] ? kstrdup+0x31/0x53
[<c04a46aa>] vfs_kern_mount+0x40/0x7b
[<c04a4733>] do_kern_mount+0x37/0xbf
[<c04b5dc6>] do_mount+0x5c4/0x61b
[<c04b477a>] ? copy_mount_options+0x2c/0x111
[<c04b5e86>] sys_mount+0x69/0xa0
[<c0403351>] sysenter_do_call+0x12/0x31
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
