Re: [nfs, rpc] crap with refcounting and rmmod races

[Al Viro <viro-3bDd1+5oDREiFSDQTTA3OLVCufUGDwFn@public.gmane.org>]

On Wed, Jun 22, 2011 at 08:12:40PM +0100, Al Viro wrote:

> 	Note that extra references to vfsmount do not prevent umount from
> removing the sucker from the tree and dropping the preexisting reference
> to it.  umount -l will do that just fine.
> 
> 	This thing is called as ->rpc_release(); do we have anything
> protecting the issuer of rpc_run_task() from being rmmod'ed before (or
> during) the call of ->rpc_release()?

Ah, I see...  All these suckers end up running from rpc_task_free(),
scheduled via nfsiod_workqueue.  Reference to vfsmount or superblock
(in case of async_unlink; async close should also use nfs_sb_{,de}active()
instead of playing with vfsmounts, BTW) pins the module down until we
are into the ->rpc_release() in question.  And rmmod nfd done after
that point will wait in destroy_workqueue() called by nfsiod_stop().

Subtle and worth documenting explicitly, IMO...
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html