| From 1c8158eeae0f37d0eee9f1fbe68080df6a408df2 Mon Sep 17 00:00:00 2001 |
| From: Li Zefan <lizefan@huawei.com> |
| Date: Tue, 18 Jun 2013 18:41:10 +0800 |
| Subject: cgroup: fix umount vs cgroup_event_remove() race |
| |
| From: Li Zefan <lizefan@huawei.com> |
| |
| commit 1c8158eeae0f37d0eee9f1fbe68080df6a408df2 upstream. |
| |
| commit 5db9a4d99b0157a513944e9a44d29c9cec2e91dc |
| Author: Tejun Heo <tj@kernel.org> |
| Date: Sat Jul 7 16:08:18 2012 -0700 |
| |
| cgroup: fix cgroup hierarchy umount race |
| |
| This commit fixed a race caused by the dput() in css_dput_fn(), but |
| the dput() in cgroup_event_remove() can also lead to the same BUG(). |
| |
| Signed-off-by: Li Zefan <lizefan@huawei.com> |
| Signed-off-by: Tejun Heo <tj@kernel.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| kernel/cgroup.c | 25 +++++++++++++++++++------ |
| 1 file changed, 19 insertions(+), 6 deletions(-) |
| |
| --- a/kernel/cgroup.c |
| +++ b/kernel/cgroup.c |
| @@ -3773,6 +3773,23 @@ static int cgroup_write_notify_on_releas |
| } |
| |
| /* |
| + * When dput() is called asynchronously, if umount has been done and |
| + * then deactivate_super() in cgroup_free_fn() kills the superblock, |
| + * there's a small window that vfs will see the root dentry with non-zero |
| + * refcnt and trigger BUG(). |
| + * |
| + * That's why we hold a reference before dput() and drop it right after. |
| + */ |
| +static void cgroup_dput(struct cgroup *cgrp) |
| +{ |
| + struct super_block *sb = cgrp->root->sb; |
| + |
| + atomic_inc(&sb->s_active); |
| + dput(cgrp->dentry); |
| + deactivate_super(sb); |
| +} |
| + |
| +/* |
| * Unregister event and free resources. |
| * |
| * Gets called from workqueue. |
| @@ -3792,7 +3809,7 @@ static void cgroup_event_remove(struct w |
| |
| eventfd_ctx_put(event->eventfd); |
| kfree(event); |
| - dput(cgrp->dentry); |
| + cgroup_dput(cgrp); |
| } |
| |
| /* |
| @@ -4075,12 +4092,8 @@ static void css_dput_fn(struct work_stru |
| { |
| struct cgroup_subsys_state *css = |
| container_of(work, struct cgroup_subsys_state, dput_work); |
| - struct dentry *dentry = css->cgroup->dentry; |
| - struct super_block *sb = dentry->d_sb; |
| |
| - atomic_inc(&sb->s_active); |
| - dput(dentry); |
| - deactivate_super(sb); |
| + cgroup_dput(css->cgroup); |
| } |
| |
| static void init_cgroup_css(struct cgroup_subsys_state *css, |
