From mboxrd@z Thu Jan 1 00:00:00 1970 From: Li Zefan Subject: Re: [PATCH] memcg: take reference before releasing rcu_read_lock Date: Sat, 30 Mar 2013 08:35:02 +0800 Message-ID: <51563336.701@huawei.com> References: <51556CE9.9060000@huawei.com> <5155718A.90108@parallels.com> Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <5155718A.90108-bzQdu9zFT3WakBO8gow8eQ@public.gmane.org> Sender: cgroups-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-ID: Content-Type: text/plain; charset="us-ascii" To: Glauber Costa Cc: Michal Hocko , KAMEZAWA Hiroyuki , Johannes Weiner , LKML , Cgroups , linux-mm-Bw31MaZKKs3YtjvyW6yDsg@public.gmane.org, Andrew Morton On 2013/3/29 18:48, Glauber Costa wrote: > On 03/29/2013 02:28 PM, Li Zefan wrote: >> The memcg is not referenced, so it can be destroyed at anytime right >> after we exit rcu read section, so it's not safe to access it. >> >> To fix this, we call css_tryget() to get a reference while we're still >> in rcu read section. >> >> This also removes a bogus comment above __memcg_create_cache_enqueue(). >> > Out of curiosity, did you see that happening ? > Just by code inspection. This is not the only place you use RCU in this wrong way. Remember the last patch I sent? ;) > Theoretically, the race you describe seem real, and the fix is sound. > From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from psmtp.com (na3sys010amx197.postini.com [74.125.245.197]) by kanga.kvack.org (Postfix) with SMTP id 427636B0002 for ; Fri, 29 Mar 2013 20:35:46 -0400 (EDT) Message-ID: <51563336.701@huawei.com> Date: Sat, 30 Mar 2013 08:35:02 +0800 From: Li Zefan MIME-Version: 1.0 Subject: Re: [PATCH] memcg: take reference before releasing rcu_read_lock References: <51556CE9.9060000@huawei.com> <5155718A.90108@parallels.com> In-Reply-To: <5155718A.90108@parallels.com> Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: 7bit Sender: owner-linux-mm@kvack.org List-ID: To: Glauber Costa Cc: Michal Hocko , KAMEZAWA Hiroyuki , Johannes Weiner , LKML , Cgroups , linux-mm@kvack.org, Andrew Morton On 2013/3/29 18:48, Glauber Costa wrote: > On 03/29/2013 02:28 PM, Li Zefan wrote: >> The memcg is not referenced, so it can be destroyed at anytime right >> after we exit rcu read section, so it's not safe to access it. >> >> To fix this, we call css_tryget() to get a reference while we're still >> in rcu read section. >> >> This also removes a bogus comment above __memcg_create_cache_enqueue(). >> > Out of curiosity, did you see that happening ? > Just by code inspection. This is not the only place you use RCU in this wrong way. Remember the last patch I sent? ;) > Theoretically, the race you describe seem real, and the fix is sound. > -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757434Ab3C3Afn (ORCPT ); Fri, 29 Mar 2013 20:35:43 -0400 Received: from szxga01-in.huawei.com ([119.145.14.64]:39661 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1757339Ab3C3Afl (ORCPT ); Fri, 29 Mar 2013 20:35:41 -0400 Message-ID: <51563336.701@huawei.com> Date: Sat, 30 Mar 2013 08:35:02 +0800 From: Li Zefan User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:17.0) Gecko/20130307 Thunderbird/17.0.4 MIME-Version: 1.0 To: Glauber Costa CC: Michal Hocko , KAMEZAWA Hiroyuki , Johannes Weiner , LKML , Cgroups , , Andrew Morton Subject: Re: [PATCH] memcg: take reference before releasing rcu_read_lock References: <51556CE9.9060000@huawei.com> <5155718A.90108@parallels.com> In-Reply-To: <5155718A.90108@parallels.com> Content-Type: text/plain; charset="GB2312" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.135.68.215] X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2013/3/29 18:48, Glauber Costa wrote: > On 03/29/2013 02:28 PM, Li Zefan wrote: >> The memcg is not referenced, so it can be destroyed at anytime right >> after we exit rcu read section, so it's not safe to access it. >> >> To fix this, we call css_tryget() to get a reference while we're still >> in rcu read section. >> >> This also removes a bogus comment above __memcg_create_cache_enqueue(). >> > Out of curiosity, did you see that happening ? > Just by code inspection. This is not the only place you use RCU in this wrong way. Remember the last patch I sent? ;) > Theoretically, the race you describe seem real, and the fix is sound. >