[PATCH] cgroups: Account for CSS_DEACT_BIAS in __css_put

[PATCH] cgroups: Account for CSS_DEACT_BIAS in __css_put

[Salman Qazi]

When we fixed the race between atomic_dec and css_refcnt, we missed
the fact that css_refcnt internally subtracts CSS_DEACT_BIAS to get
the actual reference count.  This can potentially cause a refcount leak
if __css_put races with cgroup_clear_css_refs.

Signed-off-by: Salman Qazi <sqazi-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
---
 kernel/cgroup.c |   12 ++++++++++--
 1 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index ceeafe8..2097684 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -255,12 +255,17 @@ int cgroup_lock_is_held(void)
 
 EXPORT_SYMBOL_GPL(cgroup_lock_is_held);
 
+static int css_unbias_refcnt(int refcnt)
+{
+	return refcnt >= 0 ? refcnt : refcnt - CSS_DEACT_BIAS;
+}
+
 /* the current nr of refs, always >= 0 whether @css is deactivated or not */
 static int css_refcnt(struct cgroup_subsys_state *css)
 {
 	int v = atomic_read(&css->refcnt);
 
-	return v >= 0 ? v : v - CSS_DEACT_BIAS;
+	return css_unbias_refcnt(v);
 }
 
 /* convenient tests for these bits */
@@ -4982,9 +4987,12 @@ EXPORT_SYMBOL_GPL(__css_tryget);
 void __css_put(struct cgroup_subsys_state *css)
 {
 	struct cgroup *cgrp = css->cgroup;
+	int v;
 
 	rcu_read_lock();
-	switch (atomic_dec_return(&css->refcnt)) {
+	v = css_unbias_refcnt(atomic_dec_return(&css->refcnt));
+
+	switch (v) {
 	case 1:
 		if (notify_on_release(cgrp)) {
 			set_bit(CGRP_RELEASABLE, &cgrp->flags);

Re: [PATCH] cgroups: Account for CSS_DEACT_BIAS in __css_put

[Li Zefan]

On 2012/6/15 5:55, Salman Qazi wrote:

> When we fixed the race between atomic_dec and css_refcnt, we missed
> the fact that css_refcnt internally subtracts CSS_DEACT_BIAS to get
> the actual reference count.  This can potentially cause a refcount leak
> if __css_put races with cgroup_clear_css_refs.
> 
> Signed-off-by: Salman Qazi <sqazi-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>


Hope we've got everything right this time!

Acked-by: Li Zefan <lizefan-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>

Re: [PATCH] cgroups: Account for CSS_DEACT_BIAS in __css_put

[Tejun Heo]

On Fri, Jun 15, 2012 at 03:20:28PM +0800, Li Zefan wrote:
> On 2012/6/15 5:55, Salman Qazi wrote:
> 
> > When we fixed the race between atomic_dec and css_refcnt, we missed
> > the fact that css_refcnt internally subtracts CSS_DEACT_BIAS to get
> > the actual reference count.  This can potentially cause a refcount leak
> > if __css_put races with cgroup_clear_css_refs.
> > 
> > Signed-off-by: Salman Qazi <sqazi-hpIqsD4AKlfQT0dZR+AlfA@public.gmane.org>
> 
> 
> Hope we've got everything right this time!
> 
> Acked-by: Li Zefan <lizefan-hv44wF8Li93QT0dZR+AlfA@public.gmane.org>

Applied to for-3.5-fixes.  Thanks.

-- 
tejun