linux-kernel - Re: [PATCH] cgroup: fix dentry still in use bug when dropping css refs after umount

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 30 Jun 2012 23:34:02 +0900
From:	Masanari Iida <standby24x7@...il.com>
To:	Li Zefan <lizefan@...wei.com>
Cc:	Tejun Heo <tj@...nel.org>, shyju pv <shyju.pv@...wei.com>,
	Sanil kumar <sanil.kumar@...wei.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Cgroups <cgroups@...r.kernel.org>, viro@...iv.linux.org.uk
Subject: Re: [PATCH] cgroup: fix dentry still in use bug when dropping css
 refs after umount

Hello

Apply the patch on top of 3.5-rc4, and confirmed
the symptom has fixed by your patch.
Thank you!

Tested-by: Masanari Iida <standby24x7@...il.com>

Masanari

On Sat, Jun 30, 2012 at 4:07 PM, Li Zefan <lizefan@...wei.com> wrote:
> To avoid rmdir hang, now we won't drain css references at rmdir, but
> rmdir will proceed regardless of css refs. We still have to wait till
> all css refs have been released before destroying cgroup, and this is
> achieved by holding an extra dentry refcnt for each css, which leads to
> this bug:
>
> BUG: Dentry ffff8801164db490{i=491b,n=/} still in use (1) [unmount of cgroup cgroup]
> ------------[ cut here ]------------
> kernel BUG at fs/dcache.c:965!
> ...
> Call Trace:
>  [<ffffffff811ec19a>] shrink_dcache_for_umount+0x4a/0x90
>  [<ffffffff811cc3c7>] generic_shutdown_super+0x37/0x160
>  [<ffffffff811cc5d9>] kill_anon_super+0x19/0x40
>  [<ffffffff811cc63a>] kill_litter_super+0x3a/0x50
>  [<ffffffff810fb65a>] cgroup_kill_sb+0x20a/0x280
>  [<ffffffff811ccdc5>] deactivate_locked_super+0x65/0xb0
>  [<ffffffff811ce339>] deactivate_super+0x89/0xe0
>  [<ffffffff810f7734>] cgroup_d_release+0x34/0x40
>  [<ffffffff811eb258>] d_free+0x58/0xc0
>  [<ffffffff811ee5f0>] dput+0x220/0x350
>  [<ffffffff810f7429>] css_dput_fn+0x19/0x30
>  [<ffffffff8107b4d9>] process_one_work+0x239/0x800
>  [<ffffffff8107eba3>] worker_thread+0x2e3/0x710
>  [<ffffffff81087e46>] kthread+0xd6/0xf0
>
> If there's a css ref dangling after umount, when the ref goes down
> to 0, dput will drop the cgroup's dentry and then drop the root
> dentry. But kill_sb will be called inbetween, as dropping cgroup dentry
> unpinned sb, and now vfs will find the root dentry's refcnt is not 0.
>
> To fix this, we make css pin cgroup instead of cgroup dentry.
>
> Reported-by: Shyju P V <shyju.pv@...wei.com>
> Reported-by: Masanari Iida <standby24x7@...il.com>
> Signed-off-by: Li Zefan <lizefan@...wei.com>
> ---
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/