Revision b1dd693e5b9348bd68a80e679e03cf9c0973b01b authored by Daisuke Nishimura on 24 November 2010, 20:57:06 UTC, committed by Linus Torvalds on 24 November 2010, 21:50:44 UTC
__mem_cgroup_try_charge() can be called under down_write(&mmap_sem)(e.g.
mlock does it). This means it can cause deadlock if it races with move charge:

Ex.1)
                move charge             |        try charge
  --------------------------------------+------------------------------
    mem_cgroup_can_attach()             |  down_write(&mmap_sem)
      mc.moving_task = current          |    ..
      mem_cgroup_precharge_mc()         |  __mem_cgroup_try_charge()
        mem_cgroup_count_precharge()    |    prepare_to_wait()
          down_read(&mmap_sem)          |    if (mc.moving_task)
          -> cannot aquire the lock     |    -> true
                                        |      schedule()

Ex.2)
                move charge             |        try charge
  --------------------------------------+------------------------------
    mem_cgroup_can_attach()             |
      mc.moving_task = current          |
      mem_cgroup_precharge_mc()         |
        mem_cgroup_count_precharge()    |
          down_read(&mmap_sem)          |
          ..                            |
          up_read(&mmap_sem)            |
                                        |  down_write(&mmap_sem)
    mem_cgroup_move_task()              |    ..
      mem_cgroup_move_charge()          |  __mem_cgroup_try_charge()
        down_read(&mmap_sem)            |    prepare_to_wait()
        -> cannot aquire the lock       |    if (mc.moving_task)
                                        |    -> true
                                        |      schedule()

To avoid this deadlock, we do all the move charge works (both can_attach() and
attach()) under one mmap_sem section.
And after this patch, we set/clear mc.moving_task outside mc.lock, because we
use the lock only to check mc.from/to.

Signed-off-by: Daisuke Nishimura <nishimura@mxp.nes.nec.co.jp>
Cc: Balbir Singh <balbir@linux.vnet.ibm.com>
Acked-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
1 parent 11e7946
History
File Mode Size
Kconfig -rw-r--r-- 16.8 KB
Makefile -rw-r--r-- 1.8 KB
act_api.c -rw-r--r-- 23.5 KB
act_csum.c -rw-r--r-- 13.2 KB
act_gact.c -rw-r--r-- 5.4 KB
act_ipt.c -rw-r--r-- 7.4 KB
act_mirred.c -rw-r--r-- 6.8 KB
act_nat.c -rw-r--r-- 7.3 KB
act_pedit.c -rw-r--r-- 6.2 KB
act_police.c -rw-r--r-- 9.9 KB
act_simple.c -rw-r--r-- 5.2 KB
act_skbedit.c -rw-r--r-- 5.7 KB
cls_api.c -rw-r--r-- 13.7 KB
cls_basic.c -rw-r--r-- 6.5 KB
cls_cgroup.c -rw-r--r-- 7.2 KB
cls_flow.c -rw-r--r-- 16.3 KB
cls_fw.c -rw-r--r-- 8.3 KB
cls_route.c -rw-r--r-- 12.2 KB
cls_rsvp.c -rw-r--r-- 761 bytes
cls_rsvp.h -rw-r--r-- 14.7 KB
cls_rsvp6.c -rw-r--r-- 768 bytes
cls_tcindex.c -rw-r--r-- 11.7 KB
cls_u32.c -rw-r--r-- 16.6 KB
em_cmp.c -rw-r--r-- 2.1 KB
em_meta.c -rw-r--r-- 21.4 KB
em_nbyte.c -rw-r--r-- 1.9 KB
em_text.c -rw-r--r-- 3.7 KB
em_u32.c -rw-r--r-- 1.4 KB
ematch.c -rw-r--r-- 14.5 KB
sch_api.c -rw-r--r-- 40.7 KB
sch_atm.c -rw-r--r-- 19.0 KB
sch_blackhole.c -rw-r--r-- 1.2 KB
sch_cbq.c -rw-r--r-- 47.5 KB
sch_drr.c -rw-r--r-- 11.4 KB
sch_dsmark.c -rw-r--r-- 11.2 KB
sch_fifo.c -rw-r--r-- 4.3 KB
sch_generic.c -rw-r--r-- 20.7 KB
sch_gred.c -rw-r--r-- 13.3 KB
sch_hfsc.c -rw-r--r-- 40.6 KB
sch_htb.c -rw-r--r-- 41.9 KB
sch_ingress.c -rw-r--r-- 3.2 KB
sch_mq.c -rw-r--r-- 5.6 KB
sch_multiq.c -rw-r--r-- 9.3 KB
sch_netem.c -rw-r--r-- 15.3 KB
sch_prio.c -rw-r--r-- 8.3 KB
sch_red.c -rw-r--r-- 7.9 KB
sch_sfq.c -rw-r--r-- 14.0 KB
sch_tbf.c -rw-r--r-- 10.4 KB
sch_teql.c -rw-r--r-- 12.0 KB

back to top