On Sat, Mar 02, 2013 at 03:00:28AM -0800, Russ Dill wrote: > CPU0 calls syscall fcntl(fd, F_SETFL, FASYNC) > fcntl calls fdget_raw, the count on the filp is 1, so it is not > incremented (no reference taken) > fcntl calls do_fcntl, which calls setfl which calls filp->op->fasync > which calls fasync_helper > fasync_helper calls fasync_add_entry, which calls fasync_insert_entry > fasync_insert_entry adds a fasync_struct to the list for the current > filp and assigns the pointer, > before getting to filp->f_flags |= FASYNC, we go to CPU1 > > CPU1 calls fput on the same filp, the counter is decremented to 0 and > that filp is either added to the delayed_fput_list or scheduled for > ____fput task_work.
Stop here. Just how does CPU1 manage to do that? fdget_raw() will not increment ->f_count *only* if there's nobody else with reference to its descriptor table. And if ->f_count is 1, we'd better have no references outside of that descriptor table. So where had the reference dropped by process on CPU1 come from? -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
