Re: [PATCH] module: Fix race condition between load and unload module

2013-04-13 Thread Al Viro
On Sat, Apr 13, 2013 at 09:42:06PM -0700, Anatol Pomozov wrote: > > in kobject_cleanup(). Why don't we require kobject_del() before the final > > kobject_put(), if the sucker had been added? FWIW, I thought it *was* > > required all along... > > But kobject_release/kobject_cleanup function is c

Re: [PATCH] module: Fix race condition between load and unload module

2013-04-13 Thread Anatol Pomozov
Hi On Sat, Apr 13, 2013 at 8:35 PM, Al Viro wrote: > On Fri, Apr 12, 2013 at 04:47:50PM -0700, Linus Torvalds wrote: >> This is a much more generic bug in kobjects, and I would hate to add >> some random workaround for just one case of this bug like you do. The >> more fundamental bug needs to be

Re: [PATCH] module: Fix race condition between load and unload module

2013-04-13 Thread Al Viro
On Fri, Apr 12, 2013 at 04:47:50PM -0700, Linus Torvalds wrote: > This is a much more generic bug in kobjects, and I would hate to add > some random workaround for just one case of this bug like you do. The > more fundamental bug needs to be fixed too. > > I think the more fundamental bugfix is to

Re: [PATCH] module: Fix race condition between load and unload module

2013-04-13 Thread Anatol Pomozov
Hi On Sat, Apr 13, 2013 at 10:53 AM, Linus Torvalds wrote: > On Sat, Apr 13, 2013 at 8:41 AM, Anatol Pomozov > wrote: >> >> Does it make sense to move it to a separate function in kref.h? >> >> /** Useful when kref_get is racing with kref_put and refcounter might be 0 */ >> int kref_get_not_zero

Re: [PATCH] module: Fix race condition between load and unload module

2013-04-13 Thread Linus Torvalds
On Sat, Apr 13, 2013 at 8:41 AM, Anatol Pomozov wrote: > > Does it make sense to move it to a separate function in kref.h? > > /** Useful when kref_get is racing with kref_put and refcounter might be 0 */ > int kref_get_not_zero(kref* ref) { > return atomic_inc_not_zero(&kref->refcount); > }

Re: [PATCH] module: Fix race condition between load and unload module

2013-04-13 Thread Anatol Pomozov
Hi On Fri, Apr 12, 2013 at 4:47 PM, Linus Torvalds wrote: > On Fri, Apr 12, 2013 at 3:32 PM, Anatol Pomozov > wrote: >> >> Here is timeline for the crash in case if kset_find_obj() searches for >> an object tht nobody holds and other thread is doing kobject_put() >> on the same kobject: >> >> TH

Re: [PATCH] module: Fix race condition between load and unload module

2013-04-12 Thread Anatol Pomozov
I ran the test case for ~30 minutes and no crash. Before the patch it took ~10 seconds for me to repro the crash. The only harmless warning I see is [ 1553.658421] [ cut here ] [ 1553.663211] WARNING: at fs/sysfs/dir.c:536 sysfs_add_one+0xbb/0xe0() [ 1553.669571] Hardware

Re: [PATCH] module: Fix race condition between load and unload module

2013-04-12 Thread Linus Torvalds
On Fri, Apr 12, 2013 at 4:53 PM, Greg Kroah-Hartman wrote: > > Linus, I think your patch will reduce the window the race could happen, > but it should still be there, although testing with it would be > interesting to see if the original problem can be triggered with it. Well, with my patch, ther

Re: [PATCH] module: Fix race condition between load and unload module

2013-04-12 Thread Anatol Pomozov
Hi On Fri, Apr 12, 2013 at 4:53 PM, Greg Kroah-Hartman wrote: > On Fri, Apr 12, 2013 at 04:47:50PM -0700, Linus Torvalds wrote: >> On Fri, Apr 12, 2013 at 3:32 PM, Anatol Pomozov >> wrote: >> > >> > Here is timeline for the crash in case if kset_find_obj() searches for >> > an object tht nobody

Re: [PATCH] module: Fix race condition between load and unload module

2013-04-12 Thread Greg Kroah-Hartman
On Fri, Apr 12, 2013 at 04:47:50PM -0700, Linus Torvalds wrote: > On Fri, Apr 12, 2013 at 3:32 PM, Anatol Pomozov > wrote: > > > > Here is timeline for the crash in case if kset_find_obj() searches for > > an object tht nobody holds and other thread is doing kobject_put() > > on the same kobject:

Re: [PATCH] module: Fix race condition between load and unload module

2013-04-12 Thread Linus Torvalds
On Fri, Apr 12, 2013 at 3:32 PM, Anatol Pomozov wrote: > > Here is timeline for the crash in case if kset_find_obj() searches for > an object tht nobody holds and other thread is doing kobject_put() > on the same kobject: > > THREAD A (calls kset_find_obj()) THREAD B (calls kobject_put()) > sp

[PATCH] module: Fix race condition between load and unload module

2013-04-12 Thread Anatol Pomozov
Here is a test case while true; do losetup /dev/loop0 ./loop.file; losetup -d /dev/loop0; done & while true; do rmmod loop; done & that produces following oops: [ 181.486775] loop: module is already loaded [ 181.490901] BUG: unable to handle kernel paging request at a18a600c [ 181