Merge branch 'for-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fixes from Tejun Heo:
 "The previous cgroup pull request contained a patch to fix a race
  condition during cgroup hierarchy umount.  Unfortunately, while the
  patch reduced the race window such that the test case I and Sasha were
  using didn't trigger it anymore, it wasn't complete - Shyju and Li
  could reliably trigger the race condition using a different test case.

  The problem wasn't the gap between dentry deletion and release which
  the previous patch tried to fix.  The window was between the last
  dput() of a root's child and the resulting dput() of the root.  For
  cgroup dentries, the deletion and release always happen synchronously.
  As this releases the s_active ref, the refcnt of the root dentry,
  which doesn't hold s_active, stays above zero without the
  corresponding s_active.  If umount was in progress, the last
  deactivate_super() proceeds to destory the superblock and triggers
  BUG() on the non-zero root dentry refcnt after shrinking.

  This issue surfaced because cgroup dentries are now allowed to linger
  after rmdir(2) since 3.5-rc1.  Before, rmdir synchronously drained the
  dentry refcnt and the s_active acquired by rmdir from vfs layer
  protected the whole thing.  After 3.5-rc1, cgroup may internally hold
  and put dentry refs after rmdir finishes and the delayed dput()
  doesn't have surrounding s_active ref exposing this issue.

  This pull request contains two patches - one reverting the previous
  incorrect fix and the other adding the surrounding s_active ref around
  the delayed dput().

  This is quite late in the release cycle but the change is on the safer
  side and fixes the test cases reliably, so I don't think it's too
  crazy."

* 'for-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup: fix cgroup hierarchy umount race
  Revert "cgroup: superblock can't be released with active dentries"
This commit is contained in:
Linus Torvalds 2012-07-08 09:09:27 -07:00
commit 8c84bf4166

View File

@ -901,13 +901,10 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode)
mutex_unlock(&cgroup_mutex);
/*
* We want to drop the active superblock reference from the
* cgroup creation after all the dentry refs are gone -
* kill_sb gets mighty unhappy otherwise. Mark
* dentry->d_fsdata with cgroup_diput() to tell
* cgroup_d_release() to call deactivate_super().
* Drop the active superblock reference that we took when we
* created the cgroup
*/
dentry->d_fsdata = cgroup_diput;
deactivate_super(cgrp->root->sb);
/*
* if we're getting rid of the cgroup, refcount should ensure
@ -933,13 +930,6 @@ static int cgroup_delete(const struct dentry *d)
return 1;
}
static void cgroup_d_release(struct dentry *dentry)
{
/* did cgroup_diput() tell me to deactivate super? */
if (dentry->d_fsdata == cgroup_diput)
deactivate_super(dentry->d_sb);
}
static void remove_dir(struct dentry *d)
{
struct dentry *parent = dget(d->d_parent);
@ -1547,7 +1537,6 @@ static int cgroup_get_rootdir(struct super_block *sb)
static const struct dentry_operations cgroup_dops = {
.d_iput = cgroup_diput,
.d_delete = cgroup_delete,
.d_release = cgroup_d_release,
};
struct inode *inode =
@ -3894,8 +3883,12 @@ static void css_dput_fn(struct work_struct *work)
{
struct cgroup_subsys_state *css =
container_of(work, struct cgroup_subsys_state, dput_work);
struct dentry *dentry = css->cgroup->dentry;
struct super_block *sb = dentry->d_sb;
dput(css->cgroup->dentry);
atomic_inc(&sb->s_active);
dput(dentry);
deactivate_super(sb);
}
static void init_cgroup_css(struct cgroup_subsys_state *css,