From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from psmtp.com (na3sys010amx106.postini.com [74.125.245.106]) by kanga.kvack.org (Postfix) with SMTP id 1B5D76B005C for ; Wed, 30 May 2012 09:37:49 -0400 (EDT) Received: by vcbfl10 with SMTP id fl10so3681786vcb.14 for ; Wed, 30 May 2012 06:37:48 -0700 (PDT) Date: Wed, 30 May 2012 15:37:39 +0200 From: Frederic Weisbecker Subject: Re: [PATCH v3 16/28] memcg: kmem controller charge/uncharge infrastructure Message-ID: <20120530133736.GF25094@somewhere.redhat.com> References: <1337951028-3427-1-git-send-email-glommer@parallels.com> <1337951028-3427-17-git-send-email-glommer@parallels.com> <20120530130416.GD25094@somewhere.redhat.com> <4FC61B4E.2060206@parallels.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <4FC61B4E.2060206@parallels.com> Sender: owner-linux-mm@kvack.org List-ID: To: Glauber Costa Cc: linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, linux-mm@kvack.org, kamezawa.hiroyu@jp.fujitsu.com, Tejun Heo , Li Zefan , Greg Thelen , Suleiman Souhlal , Michal Hocko , Johannes Weiner , devel@openvz.org, David Rientjes , Christoph Lameter , Pekka Enberg On Wed, May 30, 2012 at 05:06:22PM +0400, Glauber Costa wrote: > On 05/30/2012 05:04 PM, Frederic Weisbecker wrote: > >Do you think it's possible that this memcg can be destroyed (like ss->destroy()) > >concurrently? > > > >Probably not because there is a synchronize_rcu() in cgroup_diput() so as long > >as we are in rcu_read_lock() we are fine. > > > >OTOH current->mm->owner can exit() right after we fetched its memcg and thus the css_set > >can be freed concurrently? And then the cgroup itself after we call rcu_read_unlock() > >due to cgroup_diput(). > >And yet we are doing the mem_cgroup_get() below unconditionally assuming it's > >always fine to get a reference to it. > > > >May be I'm missing something? > When a cache is created, we grab a reference to the memcg. So after > the cache is created, no. > > When destroy is called, we flush the create queue, so if the cache > is not created yet, it will just disappear. > > I think the only problem that might happen is in the following scenario: > > * cache gets created, but ref count is not yet taken > * memcg disappears > * we try to inc refcount for a non-existent memcg, and crash. > > This would be trivially solvable by grabing the reference earlier. > But even then, I need to audit this further to make sure it is > really an issue. Right. __mem_cgroup_get_kmem_cache() fetches the memcg of the owner and calls memcg_create_cache_enqueue() which does css_tryget(&memcg->css). After this tryget I think you're fine. And in-between you're safe against css_set removal due to rcu_read_lock(). I'm less clear with __mem_cgroup_new_kmem_page() though... -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/ Don't email: email@kvack.org