On Fri, Feb 18, 2022 at 10:08:05AM -0600, Eric W. Biederman wrote:
>
> Maybe I am reading the lifetimes wrong but is there
> any chance the code can just do something like the diff below?
>
> AKA have a special version of kern_umount that does the call_rcu?
>
> Looking at rcu_reclaim_tiny I think this use of mnt_rcu is valid.
> AKA reusing the rcu_head in the rcu callback.
As long as you don't try to pass a given rcu_head structure to call_rcu()
before some previous call_rcu() has invoked the corresponding callback,
this can work. Careful, though, because rcu_reclaim_tiny() is part of
Tiny RCU, which assumes NR_CPUS=1. ;-)
The DEBUG_OBJECTS_RCU_HEAD Kconfig option checks for double-call_rcu()
of a single rcu_head structure. Of course, you would need a test that
actually forces a race between the other uses of ->mnt_rcu.
Except that it looks like mntput_no_expire() is using ->mnt_rcu for
other purposes, which DEBUG_OBJECTS_RCU_HEAD is blissfully unaware of.
But doesn't mntput() call mntput_no_expire(), which in turn calls
lock_mount_hash(), which calls write_seqlock(), which is not going to
be happy in an RCU callback's BH-disabled execution context? Or did
I miss a turn in there somewhere?
Thanx, Paul
> diff --git a/fs/namespace.c b/fs/namespace.c
> index 40b994a29e90..7d7aaef1592e 100644
> --- a/fs/namespace.c
> +++ b/fs/namespace.c
> @@ -4395,6 +4395,22 @@ void kern_unmount(struct vfsmount *mnt)
> }
> EXPORT_SYMBOL(kern_unmount);
>
> +static void rcu_mntput(struct rcu_head *head)
> +{
> + struct mount *mnt = container_of(head, struct mount, mnt_rcu);
> + mntput(&mnt->mnt);
> +}
> +
> +void kern_rcu_unmount(struct vfsmount *mnt)
> +{
> + /* release long term mount so mount point can be released */
> + if (!IS_ERR_OR_NULL(mnt)) {
> + struct mount *m = real_mount(mnt);
> + m->mnt_ns = NULL;
> + call_rcu(&m->mnt_rcu, rcu_mntput);
> + }
> +}
> +
> void kern_unmount_array(struct vfsmount *mnt[], unsigned int num)
> {
> unsigned int i;
> diff --git a/ipc/mqueue.c b/ipc/mqueue.c
> index 5becca9be867..e54742f82e7d 100644
> --- a/ipc/mqueue.c
> +++ b/ipc/mqueue.c
> @@ -1700,7 +1700,7 @@ void mq_clear_sbinfo(struct ipc_namespace *ns)
>
> void mq_put_mnt(struct ipc_namespace *ns)
> {
> - kern_unmount(ns->mq_mnt);
> + kern_rcu_unmount(ns->mq_mnt);
> }
>
> static int __init init_mqueue_fs(void)
>
> Eric
