On Thu, Apr 05, 2007 at 12:01:53AM -0700, Paul Menage wrote: > I don't see how that could happen. Assuming we add the > task_lock()/task_unlock() in cpuset_exit(), then only one of the two > threads (either cpuset_exit() or attach_task() ) can copy C1 from > T1->cpuset and replace it with something new, and hence only one of > them can drop the refcount.
You are correct! We can just add the task_lock()/unlock() in cpuset_exit and be done away with the races I described. > >How's that possible? That you have a zero-refcount cpuset with non empty > >tasks in it? > > If this is the last task in cs, then cs->count will be 1. We remove > this task from cs, and decrement its count to 0. Then another cpu does > cpuset_rmdir(), takes manage_mutex, sees that the count is 0, cleans > up the cpuset, drops the dentry, and the cpuset gets freed. Then we > get to run again, and we dereference an invalid cpuset. Hmm yes ..I am surprised we arent doing a synhronize_rcu in cpuset_rmdir() before dropping the dentry. Did you want to send a patch for that? attach_task() is ugly .... -- Regards, vatsa - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
