linux-kernel - Re: 3.5-rc3: BUG: Dentry still in use (1) [unmount of cgroup cgroup]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 29 Jun 2012 10:20:11 +0800
From:	Li Zefan <lizefan@...wei.com>
To:	"tj@...nel.org" <tj@...nel.org>
CC:	shyju pv <shyju.pv@...wei.com>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
	"cgroups@...r.kernel.org" <cgroups@...r.kernel.org>,
	Sanil kumar <sanil.kumar@...wei.com>,
	Masanari Iida <standby24x7@...il.com>
Subject: Re: 3.5-rc3: BUG: Dentry still in use (1) [unmount of cgroup cgroup]

On 2012/6/29 2:07, tj@...nel.org wrote:

> Hello, Li.
> 
> On Thu, Jun 28, 2012 at 02:07:51PM +0800, Li Zefan wrote:
>>> Hmm... fa980ca87d "cgroup: superblock can't be released with active
>>> dentries" is supposed to have fixed that.  Looking into it.
>>>
>>
>>
>> I think I know what happened here:
>>
>> umount
>>   deativate_super(sb)
>>                        dput(subdir)
>>                          subdir->d_count--
>>                          d_release(subdir)
>>                            deactivate_super(sb)
>>                              shrink_dcache_for_umount(sb)
>>                                BUG(root->d_count)!!
>>                          root->d_count--
> 
> Can you please elaborate a bit?  I'm not really following?  Where does
> the last root->d_count-- come from?
> 


>From my limited knowledge about vfs internal, seems the parent's refcnt won't go down
to 0 before its children. When mkdir, the parent's refcnt will be incremented, and
after rmdir, dput(subdir) will drop subdir's refcnt and then drop parent's.

So when dropping the subdir's refcnt and leading the superblock to be killed, the root's
dentry is still > 0.

>> I use this script to reproduce the bug:
>>
>> mount -t cgroup -o cpu xxx /mnt
>> mkdir /mnt/sub
>> sleep 100 < /mnt/sub &
>> kill $!
>> wait $!
>> rmdir /mnt/sub
>> umount /mnt
> 
> Unfortunately, this doesn't reproduce the bug here either. :(
> 


I can reproduce the bug reliably.. Try s/cpu/perf or s/cpu/net_cls, which have fewer
cgroup files?
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/