Re: [PATCH] Fix race between attach_task and cpuset_exit

[Srivatsa Vaddagiri]

On Thu, Apr 05, 2007 at 12:01:53AM -0700, Paul Menage wrote:
> I don't see how that could happen. Assuming we add the
> task_lock()/task_unlock() in cpuset_exit(), then only one of the two
> threads (either cpuset_exit() or attach_task() ) can copy C1 from
> T1->cpuset and replace it with something new, and hence only one of
> them can drop the refcount.

You are correct! We can just add the task_lock()/unlock() in cpuset_exit
and be done away with the races I described.

> >How's that possible? That you have a zero-refcount cpuset with non empty
> >tasks in it?
> 
> If this is the last task in cs, then cs->count will be 1. We remove
> this task from cs, and decrement its count to 0. Then another cpu does
> cpuset_rmdir(), takes manage_mutex, sees that the count is 0, cleans
> up the cpuset, drops the dentry, and the cpuset gets freed. Then we
> get to run again, and we dereference an invalid cpuset.

Hmm yes ..I am surprised we arent doing a synhronize_rcu in
cpuset_rmdir() before dropping the dentry. Did you want to send a patch
for that?

attach_task() is ugly ....

-- 
Regards,
vatsa
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/