Re: Possible bug: detached mounts difficult to cleanup

[ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman)]

ebiederm-aS9lmoZGLiVWk0Htik3J/w@public.gmane.org (Eric W. Biederman) writes:

> Krister Johansen <kjlx-6woCzk5+qv5TrMCiz+cRkdBPR1lH4CV8@public.gmane.org> writes:
>
>> Gents,
>>
>> I wondered if a naive solution could re-walk the list of mounts
>> processed in umount_tree() and if all of the detached but locked mounts
>> had a refcount that indicated they're unused, they could be unlocked and
>> unmounted.  At least in the case of the containers I'm dealing with, the
>> the container software should be ensuring that nothing in the container
>> has a reference on anything that's under the detached portion of the
>> tree.  However, there's probably a better way to do this.
>
> So if the code is working correctly that should already happen.
>
> The design is for the parent mount to hold a reference to the submounts.
> And when the reference on the parent drops to 0.  The references on
> all of the submounts will also be dropped.
>
> I was hoping to read the code and point it out to you quickly, but I am
> not seeing it now.  I am wondering if in all of the refactoring of that
> code something was dropped/missed :(
>
> Somewhere there is supposed to be the equivalent of:
> 	pin_insert_group(&p->mnt_umount, &p->mnt_parent->mnt, &unmounted);
> when we unhash those mounts because the last count has gone away.
> Either it is very sophisticated or I am missing it.  Grr....

Ok.  I see the code now, and it should be doing the right thing.

During umount_tree the code calls pin_insert_group(...) with the
last paramenter being NULL.  That adds the mount to one or two
lists.  The mnt_pins list of the parent mount and the &unmounted
hlist.

Then later when the parent's cleanup_mnt is called if the mnt_pins
still has entries mnt_pin_kill is called.  For every mount on the
mnt_pins list drop_mountpoint is called.  Which calls dput and
mntput.

So that is how your references are supposed to be freed.  Which leaves
the question why aren't your mounts being freed?  Is a file descriptor
perhaps from a mmaped executable holding a mount reference?

Perhaps you want to manually unmount everything and see if unmount will
fail on some mount and let you see which mount has a reference to it.

Eric