Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge branch 'for-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup
Pull two cgroup fixes from Tejun Heo:
"This containes two patches fixing a refcnt race bug during css_put().
Decrementing and checking the value weren't atomic and two tasks could
think that they both pushed the counter to zero."
* 'for-3.5-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
cgroups: Account for CSS_DEACT_BIAS in __css_put
cgroup: make sure that decisions in __css_put are atomic
+10
-3
+10
-3
kernel/cgroup.c
+10
-3
kernel/cgroup.c
···
255
255
256
256
EXPORT_SYMBOL_GPL(cgroup_lock_is_held);
257
257
258
+
static int css_unbias_refcnt(int refcnt)
259
+
{
260
+
return refcnt >= 0 ? refcnt : refcnt - CSS_DEACT_BIAS;
261
+
}
262
+
258
263
/* the current nr of refs, always >= 0 whether @css is deactivated or not */
259
264
static int css_refcnt(struct cgroup_subsys_state *css)
260
265
{
261
266
int v = atomic_read(&css->refcnt);
262
267
263
-
return v >= 0 ? v : v - CSS_DEACT_BIAS;
268
+
return css_unbias_refcnt(v);
264
269
}
265
270
266
271
/* convenient tests for these bits */
···
4987
4982
void __css_put(struct cgroup_subsys_state *css)
4988
4983
{
4989
4984
struct cgroup *cgrp = css->cgroup;
4985
+
int v;
4990
4986
4991
4987
rcu_read_lock();
4992
-
atomic_dec(&css->refcnt);
4993
-
switch (css_refcnt(css)) {
4988
+
v = css_unbias_refcnt(atomic_dec_return(&css->refcnt));
4989
+
4990
+
switch (v) {
4994
4991
case 1:
4995
4992
if (notify_on_release(cgrp)) {
4996
4993
set_bit(CGRP_RELEASABLE, &cgrp->flags);