Re: [PATCH 2/2] cgroup: fix cgroup hierarchy umount race
From: Al Viro <hidden>
Date: 2012-07-14 12:09:05
Also in:
lkml
On Sat, Jul 07, 2012 at 04:46:59PM -0700, 'Tejun Heo' wrote:
Fix it by holding an extra superblock->s_active reference across dput() from css release, which is the dput() path added by 48ddbe1946 and the only one which doesn't hold an extra s_active ref across the final cgroup dput().
quoted hunk ↗ jump to hunk
@@ -3883,8 +3883,12 @@ static void css_dput_fn(struct work_struct *work) { struct cgroup_subsys_state *css = container_of(work, struct cgroup_subsys_state, dput_work); + struct dentry *dentry = css->cgroup->dentry; + struct super_block *sb = dentry->d_sb; - dput(css->cgroup->dentry); + atomic_inc(&sb->s_active); + dput(dentry); + deactivate_super(sb); }
While we are at it, what guarantees that css->dput_work will complete before css->cgroup or the object containing css get freed under us?