summaryrefslogtreecommitdiff
path: root/kernel
diff options
context:
space:
mode:
authorSalman Qazi <sqazi@google.com>2012-06-15 01:55:30 +0400
committerTejun Heo <tj@kernel.org>2012-06-19 02:38:02 +0400
commit8e3bbf42c6d73881956863cc3305456afe2bc4ea (patch)
treebb3369e7444a2efe8e890ddd341e576e3cba18c1 /kernel
parent967db0ea65b0bf8507a7643ac8f296c4f2c0a834 (diff)
downloadlinux-8e3bbf42c6d73881956863cc3305456afe2bc4ea.tar.xz
cgroups: Account for CSS_DEACT_BIAS in __css_put
When we fixed the race between atomic_dec and css_refcnt, we missed the fact that css_refcnt internally subtracts CSS_DEACT_BIAS to get the actual reference count. This can potentially cause a refcount leak if __css_put races with cgroup_clear_css_refs. Signed-off-by: Salman Qazi <sqazi@google.com> Acked-by: Li Zefan <lizefan@huawei.com> Signed-off-by: Tejun Heo <tj@kernel.org>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/cgroup.c12
1 files changed, 10 insertions, 2 deletions
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index ceeafe874b3f..2097684cf194 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -255,12 +255,17 @@ int cgroup_lock_is_held(void)
EXPORT_SYMBOL_GPL(cgroup_lock_is_held);
+static int css_unbias_refcnt(int refcnt)
+{
+ return refcnt >= 0 ? refcnt : refcnt - CSS_DEACT_BIAS;
+}
+
/* the current nr of refs, always >= 0 whether @css is deactivated or not */
static int css_refcnt(struct cgroup_subsys_state *css)
{
int v = atomic_read(&css->refcnt);
- return v >= 0 ? v : v - CSS_DEACT_BIAS;
+ return css_unbias_refcnt(v);
}
/* convenient tests for these bits */
@@ -4982,9 +4987,12 @@ EXPORT_SYMBOL_GPL(__css_tryget);
void __css_put(struct cgroup_subsys_state *css)
{
struct cgroup *cgrp = css->cgroup;
+ int v;
rcu_read_lock();
- switch (atomic_dec_return(&css->refcnt)) {
+ v = css_unbias_refcnt(atomic_dec_return(&css->refcnt));
+
+ switch (v) {
case 1:
if (notify_on_release(cgrp)) {
set_bit(CGRP_RELEASABLE, &cgrp->flags);