From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760111AbcAUV2R (ORCPT ); Thu, 21 Jan 2016 16:28:17 -0500 Received: from mail-yk0-f193.google.com ([209.85.160.193]:35725 "EHLO mail-yk0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752739AbcAUV2O (ORCPT ); Thu, 21 Jan 2016 16:28:14 -0500 Date: Thu, 21 Jan 2016 16:28:12 -0500 From: Tejun Heo To: Peter Zijlstra Cc: Christian Borntraeger , linux-kernel@vger.kernel.org, linux-s390 , KVM list , Oleg Nesterov , "Paul E. McKenney" , Li Zefan , Johannes Weiner , cgroups@vger.kernel.org, kernel-team@fb.com Subject: Re: [PATCH 1/2] cgroup: make sure a parent css isn't offlined before its children Message-ID: <20160121212812.GJ5157@mtj.duckdns.org> References: <56978452.6010606@de.ibm.com> <20160114195630.GA3520@mtj.duckdns.org> <5698A023.9070703@de.ibm.com> <20160121203111.GF5157@mtj.duckdns.org> <20160121212416.GL6357@twins.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160121212416.GL6357@twins.programming.kicks-ass.net> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Jan 21, 2016 at 10:24:16PM +0100, Peter Zijlstra wrote: > On Thu, Jan 21, 2016 at 03:31:11PM -0500, Tejun Heo wrote: > > There are three subsystem callbacks in css shutdown path - > > css_offline(), css_released() and css_free(). Except for > > css_released(), cgroup core didn't use to guarantee the order of > > invocation. css_offline() or css_free() could be called on a parent > > css before its children. This behavior is unexpected and led to > > use-after-free in cpu controller. > > > > This patch updates offline path so that a parent css is never offlined > > before its children. Each css keeps online_cnt which reaches zero iff > > itself and all its children are offline and offline_css() is invoked > > only after online_cnt reaches zero. > > > > This fixes the reported cpu controller malfunction. The next patch > > will update css_free() handling. > > No, I need to fix the cpu controller too, because the offending code > sits off of css_free() (the next patch), but also does a call_rcu() in > between, which also doesn't guarantee order. Ah, I see. Christian, can you please apply all three patches and see whether the problem gets fixed? Once verified, I'll update the patch description and repost. Thanks. -- tejun