Hello,
On Wed, Apr 17, 2019 at 04:12:29PM +0000, Konstantin Khorenko wrote:
> i don't know the full scenario unfortunately, but the idea is the following:
>
> __kernfs_remove() is called under kernfs_mutex and if
> !(!kn || (kn->parent && RB_EMPTY_NODE(&kn->rb)))
>
> it assumes that nothing can change while we hold the mutex and
> for each kernfs descendant should have kn->count > 0.
>
> =====
> /* deactivate and unlink the subtree node-by-node */
> do {
> pos = kernfs_leftmost_descendant(kn);
>
> /*
> * kernfs_drain() drops kernfs_mutex temporarily and @pos's
> * base ref could have been put by someone else by the time
> * the function returns. Make sure it doesn't go away
> * underneath us.
> */
> kernfs_get(pos);
> =====
>
> At the same time kernfs_notify_workfn() can do a kernfs_put() out of
> kernfs_mutex
> which probably can be the last put and dec kn->count to 0 any moment.
Yeah, but the caller of __kernfs_remove() should be holding the ref,
so I don't see how it'd reach zero. Also, just putting that one
kernfs_put() inside mutex can't possibly be the right solution given
that the function is allowed to be called from any context. I think
we need to understand what's going on better before making changes.
Thanks.
--
tejun
