On Tue, 8 Sep 2015, Dmitry Vyukov wrote:
> >>
> >> // kernel/pid.c
> >> if ((atomic_read(&pid->count) == 1) ||
> >> atomic_dec_and_test(&pid->count)) {
> >> kmem_cache_free(ns->pid_cachep, pid);
> >> put_pid_ns(ns);
> >> }
> >
> > It frees when there the refcount is one? Should this not be
> >
> > if (atomic_read(&pid->count) === 0) || ...
>
> The code is meant to do decrement of pid->count, but since
> pid->count==1 it figures out that it is the only owner of the object,
> so it just skips the "pid->count--" part and proceeds directly to
> free.
The atomic_dec_and_test will therefore not be executed for count == 1?
Strange code. The atomic_dec_and_test suggests there are concurrency
concerns. The count test with a simple comparison does not share these
concerns it seems.
> >> The maintainers probably want this sort of code to be allowed:
> >> p->a++;
> >> if (p->b) {
> >> kfree(p);
> >> p = NULL;
> >> }
> >> And the users even more so.
> >
> >
> > Sure. What would be the problem with the above code? The write to the
> > object (p->a++) results in exclusive access to a cacheline being obtained.
> > So one cpu holds that cacheline. Then the object is freed and reused
> > either
>
> I am not sure what cache line states has to do with it...
> Anyway, another thread can do p->c++ after this thread does p->a++,
> then this thread loses its ownership. Or p->c can be located on a
> separate cache line with p->a. And then we still free the object with
> a pending write.
The subsystem must ensure no other references exist before a call to free.
So this cannot occur. If it does then these are cases of an object being
used after free which can be caught by a number of diagnostic tools in the
kernel.
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxx. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>