[RFC PATCH] cgroup: remove redundant cleanup in css_create

classic Classic list List threaded Threaded
2 messages Options
Reply | Threaded
Open this post in threaded view
|

[RFC PATCH] cgroup: remove redundant cleanup in css_create

Wenwei Tao-3
From: Wenwei Tao <[hidden email]>

When create css failed, before call css_free_rcu_fn,
we remove the css id and exit the percpu_ref, but we
will do these again in css_free_work_fn, so they are redundant.
Especially the css id, that would cause problem if we
remove it twice, since it may be assigned to another
css after the first remove.

Signed-off-by: Wenwei Tao <[hidden email]>
---
 kernel/cgroup.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 909a7d3..9df3a29 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -5088,7 +5088,7 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
 
  err = cgroup_idr_alloc(&ss->css_idr, NULL, 2, 0, GFP_KERNEL);
  if (err < 0)
- goto err_free_percpu_ref;
+ goto err_free_css;
  css->id = err;
 
  /* @css is ready to be brought online now, make it visible */
@@ -5112,9 +5112,6 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
 
 err_list_del:
  list_del_rcu(&css->sibling);
- cgroup_idr_remove(&ss->css_idr, css->id);
-err_free_percpu_ref:
- percpu_ref_exit(&css->refcnt);
 err_free_css:
  call_rcu(&css->rcu_head, css_free_rcu_fn);
  return ERR_PTR(err);
--
1.8.3.1


Reply | Threaded
Open this post in threaded view
|

[PATCH] cgroup: remove redundant cleanup in css_create

Tejun Heo-2
Hello,

Nice catch.  I added more details to the changelog, tagged it for
-stable and applied it to cgroup/for-4.7-fixes.

Thanks!

------ 8< ------
From b00c52dae6d9ee8d0f2407118ef6544ae5524781 Mon Sep 17 00:00:00 2001
From: Wenwei Tao <[hidden email]>
Date: Fri, 13 May 2016 22:59:20 +0800

When create css failed, before call css_free_rcu_fn, we remove the css
id and exit the percpu_ref, but we will do these again in
css_free_work_fn, so they are redundant.  Especially the css id, that
would cause problem if we remove it twice, since it may be assigned to
another css after the first remove.

tj: This was broken by two commits updating the free path without
    synchronizing the creation failure path.  This can be easily
    triggered by trying to create more than 64k memory cgroups.

Signed-off-by: Wenwei Tao <[hidden email]>
Signed-off-by: Tejun Heo <[hidden email]>
Cc: Vladimir Davydov <[hidden email]>
Fixes: 9a1049da9bd2 ("percpu-refcount: require percpu_ref to be exited explicitly")
Fixes: 01e586598b22 ("cgroup: release css->id after css_free")
Cc: [hidden email] # v3.17+
---
 kernel/cgroup.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 86cb5c6..789b84f 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -5150,7 +5150,7 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
 
  err = cgroup_idr_alloc(&ss->css_idr, NULL, 2, 0, GFP_KERNEL);
  if (err < 0)
- goto err_free_percpu_ref;
+ goto err_free_css;
  css->id = err;
 
  /* @css is ready to be brought online now, make it visible */
@@ -5174,9 +5174,6 @@ static struct cgroup_subsys_state *css_create(struct cgroup *cgrp,
 
 err_list_del:
  list_del_rcu(&css->sibling);
- cgroup_idr_remove(&ss->css_idr, css->id);
-err_free_percpu_ref:
- percpu_ref_exit(&css->refcnt);
 err_free_css:
  call_rcu(&css->rcu_head, css_free_rcu_fn);
  return ERR_PTR(err);
--
2.7.4