Merge branch 'for-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull cgroup fixes from Tejun Heo: "The previous cgroup pull request contained a patch to fix a race condition during cgroup hierarchy umount. Unfortunately, while the patch reduced the race window such that the test case I and Sasha were using didn't trigger it anymore, it wasn't complete - Shyju and Li could reliably trigger the race condition using a different test case. The problem wasn't the gap between dentry deletion and release which the previous patch tried to fix. The window was between the last dput() of a root's child and the resulting dput() of the root. For cgroup dentries, the deletion and release always happen synchronously. As this releases the s_active ref, the refcnt of the root dentry, which doesn't hold s_active, stays above zero without the corresponding s_active. If umount was in progress, the last deactivate_super() proceeds to destory the superblock and triggers BUG() on the non-zero root dentry refcnt after shrinking. This issue surfaced because cgroup dentries are now allowed to linger after rmdir(2) since 3.5-rc1. Before, rmdir synchronously drained the dentry refcnt and the s_active acquired by rmdir from vfs layer protected the whole thing. After 3.5-rc1, cgroup may internally hold and put dentry refs after rmdir finishes and the delayed dput() doesn't have surrounding s_active ref exposing this issue. This pull request contains two patches - one reverting the previous incorrect fix and the other adding the surrounding s_active ref around the delayed dput(). This is quite late in the release cycle but the change is on the safer side and fixes the test cases reliably, so I don't think it's too crazy." * 'for-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: cgroup: fix cgroup hierarchy umount race Revert "cgroup: superblock can't be released with active dentries"
Please register or sign in to comment