diff options
| author |   Li Zefan <lizefan@huawei.com> | 2013-06-18 18:40:19 +0800 |
|---|---|---|
| committer |   Tejun Heo <tj@kernel.org> | 2013-06-18 09:04:30 -0700 |
| commit | 084457f284abf6789d90509ee11dae383842b23b (patch) | |
| tree | 6e401afe9c5d2b84b4d8a1877f72496b3931448d /kernel/cgroup.c | |
| parent | cgroup: disallow rename(2) if sane_behavior (diff) | |
| download | linux-dev-084457f284abf6789d90509ee11dae383842b23b.tar.xz linux-dev-084457f284abf6789d90509ee11dae383842b23b.zip | |
cgroup: fix umount vs cgroup_cfts_commit() race
cgroup_cfts_commit() uses dget() to keep cgroup alive after cgroup_mutex
is dropped, but dget() won't prevent cgroupfs from being umounted. When
the race happens, vfs will see some dentries with non-zero refcnt while
umount is in process.
Keep running this:
mount -t cgroup -o blkio xxx /cgroup
umount /cgroup
And this:
modprobe cfq-iosched
rmmod cfs-iosched
After a while, the BUG() in shrink_dcache_for_umount_subtree() may
be triggered:
BUG: Dentry xxx{i=0,n=blkio.yyy} still in use (1) [umount of cgroup cgroup]
Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Diffstat (limited to 'kernel/cgroup.c')
| -rw-r--r-- | kernel/cgroup.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/kernel/cgroup.c b/kernel/cgroup.c index c2c64005bbc2..0224f6b3103e 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -2798,13 +2798,17 @@ static void cgroup_cfts_commit(struct cgroup_subsys *ss, { LIST_HEAD(pending); struct cgroup *cgrp, *n; + struct super_block *sb = ss->root->sb; /* %NULL @cfts indicates abort and don't bother if @ss isn't attached */ - if (cfts && ss->root != &rootnode) { + if (cfts && ss->root != &rootnode && + atomic_inc_not_zero(sb->s_active)) { list_for_each_entry(cgrp, &ss->root->allcg_list, allcg_node) { dget(cgrp->dentry); list_add_tail(&cgrp->cft_q_node, &pending); } + } else { + sb = NULL; } mutex_unlock(&cgroup_mutex); @@ -2827,6 +2831,9 @@ static void cgroup_cfts_commit(struct cgroup_subsys *ss, dput(cgrp->dentry); } + if (sb) + deactivate_super(sb); + mutex_unlock(&cgroup_cft_mutex); } |