• Li Zefan's avatar
    cgroup: protect modifications to cgroup_idr with cgroup_mutex · 0ab02ca8
    Li Zefan authored
    Setup cgroupfs like this:
      # mount -t cgroup -o cpuacct xxx /cgroup
      # mkdir /cgroup/sub1
      # mkdir /cgroup/sub2
    Then run these two commands:
      # for ((; ;)) { mkdir /cgroup/sub1/tmp && rmdir /mnt/sub1/tmp; } &
      # for ((; ;)) { mkdir /cgroup/sub2/tmp && rmdir /mnt/sub2/tmp; } &
    After seconds you may see this warning:
    ------------[ cut here ]------------
    WARNING: CPU: 1 PID: 25243 at lib/idr.c:527 sub_remove+0x87/0x1b0()
    idr_remove called for id=6 which is not allocated.
    Call Trace:
     [<ffffffff8156063c>] dump_stack+0x7a/0x96
     [<ffffffff810591ac>] warn_slowpath_common+0x8c/0xc0
     [<ffffffff81059296>] warn_slowpath_fmt+0x46/0x50
     [<ffffffff81300aa7>] sub_remove+0x87/0x1b0
     [<ffffffff810f3f02>] ? css_killed_work_fn+0x32/0x1b0
     [<ffffffff81300bf5>] idr_remove+0x25/0xd0
     [<ffffffff810f2bab>] cgroup_destroy_css_killed+0x5b/0xc0
     [<ffffffff810f4000>] css_killed_work_fn+0x130/0x1b0
     [<ffffffff8107cdbc>] process_one_work+0x26c/0x550
     [<ffffffff8107eefe>] worker_thread+0x12e/0x3b0
     [<ffffffff81085f96>] kthread+0xe6/0xf0
     [<ffffffff81570bac>] ret_from_fork+0x7c/0xb0
    ---[ end trace 2d1577ec10cf80d0 ]---
    It's because allocating/removing cgroup ID is not properly synchronized.
    The bug was introduced when we converted cgroup_ida to cgroup_idr.
    While synchronization is already done inside ida_simple_{get,remove}(),
    users are responsible for concurrent calls to idr_{alloc,remove}().
    tj: Refreshed on top of b58c8998 ("cgroup: fix error return from
    Fixes: 4e96ee8e
     ("cgroup: convert cgroup_ida to cgroup_idr")
    Cc: <stable@vger.kernel.org> #3.12+
    Reported-by: default avatarMichal Hocko <mhocko@suse.cz>
    Signed-off-by: default avatarLi Zefan <lizefan@huawei.com>
    Signed-off-by: default avatarTejun Heo <tj@kernel.org>