cgroup: test css_put imbalance

Signed-off-by: Tadeusz Struk <tadeusz.struk@linaro.org> Change-Id: I0d3d27cdff508b2bb9ae2411d406f272ca46d410
tstruk · Jun 1, 2022 · 1e8d2a5 · 1e8d2a5
1 parent 56c31ac
commit 1e8d2a5
Show file tree

Hide file tree

Showing 2 changed files with 15 additions and 4 deletions.
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
@@ -400,7 +400,7 @@ static inline bool css_is_dying(struct cgroup_subsys_state *css)
  */
 static inline void css_put(struct cgroup_subsys_state *css)
 {
-	if (!(css->flags & CSS_NO_REF))
+	if (!(css->flags & CSS_NO_REF || percpu_ref_is_dying(&css->refcnt)))
 		percpu_ref_put(&css->refcnt);
 }
 
@@ -413,7 +413,7 @@ static inline void css_put(struct cgroup_subsys_state *css)
  */
 static inline void css_put_many(struct cgroup_subsys_state *css, unsigned int n)
 {
-	if (!(css->flags & CSS_NO_REF))
+	if (!(css->flags & CSS_NO_REF || percpu_ref_is_dying(&css->refcnt)))
 		percpu_ref_put_many(&css->refcnt, n);
 }
 

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
@@ -3129,6 +3129,7 @@ static void cgroup_apply_control_disable(struct cgroup *cgrp)
 
 			if (css->parent &&
 			    !(cgroup_ss_mask(dsct) & (1 << ss->id))) {
+printk("!!! cgroup_apply_control_disable kill_css %llx\n", css);
 				kill_css(css);
 			} else if (!css_visible(css)) {
 				css_clear_dir(css);
@@ -5108,6 +5109,7 @@ static void css_release(struct percpu_ref *ref)
 	struct cgroup_subsys_state *css =
 		container_of(ref, struct cgroup_subsys_state, refcnt);
 
+printk("!!! css_release css %llx !!!\n", css);
 	INIT_WORK(&css->destroy_work, css_release_work_fn);
 	queue_work(cgroup_destroy_wq, &css->destroy_work);
 }
@@ -5477,6 +5479,7 @@ static void css_killed_ref_fn(struct percpu_ref *ref)
 		container_of(ref, struct cgroup_subsys_state, refcnt);
 
 	if (atomic_dec_and_test(&css->online_cnt)) {
+printk("!!! css_killed_ref_fn css %llx !!!\n", css);
 		INIT_WORK(&css->destroy_work, css_killed_work_fn);
 		queue_work(cgroup_destroy_wq, &css->destroy_work);
 	}
@@ -5556,6 +5559,7 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
 	struct cgroup_subsys_state *css;
 	struct cgrp_cset_link *link;
 	int ssid;
+printk("!!! cgroup_destroy_locked !!!\n");
 
 	lockdep_assert_held(&cgroup_mutex);
 
@@ -5573,7 +5577,6 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
 	 */
 	if (css_has_online_children(&cgrp->self))
 		return -EBUSY;
-
 	/*
 	 * Mark @cgrp and the associated csets dead.  The former prevents
 	 * further task migration and child creation by disabling
@@ -5588,8 +5591,15 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
 	spin_unlock_irq(&css_set_lock);
 
 	/* initiate massacre of all css's */
-	for_each_css(css, ssid, cgrp)
+	for_each_css(css, ssid, cgrp) {
+printk("!!! cgroup_destroy_locked kill all css'es !!!\n");
+		if (css == &cgrp->self) {
+printk("!!! cgroup_destroy_locked skipping css %llx !!!\n", css);
+			continue;
+		}
+
 		kill_css(css);
+	}
 
 	/* clear and remove @cgrp dir, @cgrp has an extra ref on its kn */
 	css_clear_dir(&cgrp->self);
@@ -5616,6 +5626,7 @@ static int cgroup_destroy_locked(struct cgroup *cgrp)
 	cgroup_bpf_offline(cgrp);
 
 	/* put the base reference */
+printk("!!! cgroup_destroy_locked killing css %llx !!!\n", &cgrp->self);
 	percpu_ref_kill(&cgrp->self.refcnt);
 
 	return 0;