Techwizz/kernel-fxtec-pro1x
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

cgroups: Account for CSS_DEACT_BIAS in __css_put

Browse source 
When we fixed the race between atomic_dec and css_refcnt, we missed
the fact that css_refcnt internally subtracts CSS_DEACT_BIAS to get
the actual reference count.  This can potentially cause a refcount leak
if __css_put races with cgroup_clear_css_refs.

Signed-off-by: Salman Qazi <sqazi@google.com>
Acked-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
This commit is contained in:
Salman Qazi 2012-06-14 14:55:30 -07:00 committed by Tejun Heo
parent 967db0ea65
commit 8e3bbf42c6
1 changed files with 10 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
kernel/cgroup.c
View file

@ -255,12 +255,17 @@ int cgroup_lock_is_held(void)
EXPORT_SYMBOL_GPL(cgroup_lock_is_held); EXPORT_SYMBOL_GPL(cgroup_lock_is_held);
static int css_unbias_refcnt(int refcnt)
{
return refcnt >= 0 ? refcnt : refcnt - CSS_DEACT_BIAS;
}
/* the current nr of refs, always >= 0 whether @css is deactivated or not */ /* the current nr of refs, always >= 0 whether @css is deactivated or not */
static int css_refcnt(struct cgroup_subsys_state *css) static int css_refcnt(struct cgroup_subsys_state *css)
{ {
int v = atomic_read(&css->refcnt); int v = atomic_read(&css->refcnt);
return v >= 0 ? v : v - CSS_DEACT_BIAS; return css_unbias_refcnt(v);
} }
/* convenient tests for these bits */ /* convenient tests for these bits */
@ -4982,9 +4987,12 @@ EXPORT_SYMBOL_GPL(__css_tryget);
void __css_put(struct cgroup_subsys_state *css) void __css_put(struct cgroup_subsys_state *css)
{ {
struct cgroup *cgrp = css->cgroup; struct cgroup *cgrp = css->cgroup;
int v;
rcu_read_lock(); rcu_read_lock();
switch (atomic_dec_return(&css->refcnt)) { v = css_unbias_refcnt(atomic_dec_return(&css->refcnt));
switch (v) {
case 1: case 1:
if (notify_on_release(cgrp)) { if (notify_on_release(cgrp)) {
set_bit(CGRP_RELEASABLE, &cgrp->flags); set_bit(CGRP_RELEASABLE, &cgrp->flags);