The patch titled cgroups: fix probable race with put_css_set[_taskexit] and find_css_set has been added to the -mm tree. Its filename is cgroups-fix-probable-race-with-put_css_set-and-find_css_set.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: cgroups: fix probable race with put_css_set[_taskexit] and find_css_set From: Lai Jiangshan <laijs@xxxxxxxxxxxxxx> put_css_set_taskexit may be called when find_css_set is called on other cpu. And the race will occur: put_css_set_taskexit side find_css_set side | atomic_dec_and_test(&kref->refcount) | /* kref->refcount = 0 */ | .................................................................... | read_lock(&css_set_lock) | find_existing_css_set | get_css_set | read_unlock(&css_set_lock); .................................................................... __release_css_set | .................................................................... | /* use a released css_set */ | [put_css_set is the same. But in the current code, all put_css_set are put into cgroup mutex critical region as the same as find_css_set.] Signed-off-by: Lai Jiangshan <laijs@xxxxxxxxxxxxxx> Cc: Paul Menage <menage@xxxxxxxxxx> Cc: Balbir Singh <balbir@xxxxxxxxxx> Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@xxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- kernel/cgroup.c | 23 ++++++++++++++++++++--- 1 file changed, 20 insertions(+), 3 deletions(-) diff -puN kernel/cgroup.c~cgroups-fix-probable-race-with-put_css_set-and-find_css_set kernel/cgroup.c --- a/kernel/cgroup.c~cgroups-fix-probable-race-with-put_css_set-and-find_css_set +++ a/kernel/cgroup.c @@ -241,7 +241,6 @@ static void unlink_css_set(struct css_se struct cg_cgroup_link *link; struct cg_cgroup_link *saved_link; - write_lock(&css_set_lock); hlist_del(&cg->hlist); css_set_count--; @@ -251,8 +250,6 @@ static void unlink_css_set(struct css_se list_del(&link->cgrp_link_list); kfree(link); } - - write_unlock(&css_set_lock); } static void __release_css_set(struct kref *k, int taskexit) @@ -260,7 +257,13 @@ static void __release_css_set(struct kre int i; struct css_set *cg = container_of(k, struct css_set, ref); + write_lock(&css_set_lock); + if (atomic_read(&k->refcount) > 0) { + write_unlock(&css_set_lock); + return; + } unlink_css_set(cg); + write_unlock(&css_set_lock); rcu_read_lock(); for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) { @@ -410,6 +413,20 @@ static struct css_set *find_css_set( * the desired set */ read_lock(&css_set_lock); res = find_existing_css_set(oldcg, cgrp, template); + /* + * put_css_set[_taskexit]() may race with find_css_set(), in that + * find_css_set() got the css_set after put_css_set() had released it. + * + * We should put the whole put_css_set[_taskexit]() into css_set_lock's + * write_lock critical setion to avoid this race. But it will increase + * overhead for do_exit(). + * + * So we do not avoid this race but put it under control: + * __release_css_set() will re-check the refcount + * with css_set_lock held. + * + * This race may trigger the warnning in kref_get(). + */ if (res) get_css_set(res); read_unlock(&css_set_lock); _ Patches currently in -mm which might be from laijs@xxxxxxxxxxxxxx are linux-next.patch cgroups-fix-probable-race-with-put_css_set-and-find_css_set.patch cgroups-fix-probable-race-with-put_css_set-and-find_css_set-fix.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html