Commit bb78a92f authored by Hugh Dickins's avatar Hugh Dickins Committed by Tejun Heo

cgroup: fix rmdir EBUSY regression in 3.11

On 3.11-rc we are seeing cgroup directories left behind when they should
have been removed.  Here's a trivial reproducer:

cd /sys/fs/cgroup/memory
mkdir parent parent/child; rmdir parent/child parent
rmdir: failed to remove `parent': Device or resource busy

It's because cgroup_destroy_locked() (step 1 of destruction) leaves
cgroup on parent's children list, letting cgroup_offline_fn() (step 2 of
destruction) remove it; but step 2 is run by work queue, which may not
yet have removed the children when parent destruction checks the list.

Fix that by checking through a non-empty list of children: if every one
of them has already been marked CGRP_DEAD, then it's safe to proceed:
those children are invisible to userspace, and should not obstruct rmdir.

(I didn't see any reason to keep the cgrp->children checks under the
unrelated css_set_lock, so moved them out.)

tj: Flattened nested ifs a bit and updated comment so that it's
    correct on both for-3.11-fixes and for-3.12.
Signed-off-by: default avatarHugh Dickins <hughd@google.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent c95389b4
...@@ -4480,6 +4480,7 @@ static int cgroup_destroy_locked(struct cgroup *cgrp) ...@@ -4480,6 +4480,7 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
struct dentry *d = cgrp->dentry; struct dentry *d = cgrp->dentry;
struct cgroup_event *event, *tmp; struct cgroup_event *event, *tmp;
struct cgroup_subsys *ss; struct cgroup_subsys *ss;
struct cgroup *child;
bool empty; bool empty;
lockdep_assert_held(&d->d_inode->i_mutex); lockdep_assert_held(&d->d_inode->i_mutex);
...@@ -4490,11 +4491,27 @@ static int cgroup_destroy_locked(struct cgroup *cgrp) ...@@ -4490,11 +4491,27 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
* @cgrp from being removed while __put_css_set() is in progress. * @cgrp from being removed while __put_css_set() is in progress.
*/ */
read_lock(&css_set_lock); read_lock(&css_set_lock);
empty = list_empty(&cgrp->cset_links) && list_empty(&cgrp->children); empty = list_empty(&cgrp->cset_links);
read_unlock(&css_set_lock); read_unlock(&css_set_lock);
if (!empty) if (!empty)
return -EBUSY; return -EBUSY;
/*
* Make sure there's no live children. We can't test ->children
* emptiness as dead children linger on it while being destroyed;
* otherwise, "rmdir parent/child parent" may fail with -EBUSY.
*/
empty = true;
rcu_read_lock();
list_for_each_entry_rcu(child, &cgrp->children, sibling) {
empty = cgroup_is_dead(child);
if (!empty)
break;
}
rcu_read_unlock();
if (!empty)
return -EBUSY;
/* /*
* Block new css_tryget() by killing css refcnts. cgroup core * Block new css_tryget() by killing css refcnts. cgroup core
* guarantees that, by the time ->css_offline() is invoked, no new * guarantees that, by the time ->css_offline() is invoked, no new
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment