Thread (13 messages) 13 messages, 5 authors, 2021-12-23

Re: Use after free with BFQ and cgroups

From: Jan Kara <jack@suse.cz>
Date: 2021-11-30 11:50:31
Also in: linux-block

On Mon 29-11-21 07:12:42, Tejun Heo wrote:
On Fri, Nov 26, 2021 at 03:47:24PM +0100, Michal Koutný wrote:
quoted
The question here is how long would stay the offlined blkcgs around if
they were directly pinned upon the IO submission. If it's unbound, then
reparenting makes more sense.
It should be fine to pin whatever's necessary while related IOs are in
flight and percpu_ref used for css refcnting isn't gonna make any noticeable
difference in terms of overhead.
Yes, holding cgroup ref from IO would be fine. But that is not really our
problem.

The problem is bfq_queue associated with a task effectively holds a
reference to the potentially dead cgroup and the reference can stay there
until the task (that itself got reparented to the root cgroup) exits. So I
think we need to reparent these bfq_queue structures as well to avoid
holding cgroup in zombie state excessively long.

								Honza
-- 
Jan Kara [off-list ref]
SUSE Labs, CR
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help