From: Lu Jialin lujialin4@huawei.com
hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8Y0RW
--------------------------------
When read/write memory.wb_blkio_ino of a memcg, and delete the memcg at the same time, it could cause deadlock as below: CPU0 CPU1 rlock(kn->active#4); lock(cgroup_mutex); lock(kn->active#4); lock(cgroup_mutex);
Therefore, delete locking cgroup_mutex in reading/writing memory.wb_blkio_ino, just use refcnt and rcu to make sure that the blkcg exists.
Fixes: 13b8199f0a47 ("cgroup: support cgroup writeback on cgroupv1") Signed-off-by: Lu Jialin lujialin4@huawei.com Signed-off-by: Chen Ridong chenridong@huawei.com --- mm/backing-dev.c | 2 -- mm/memcontrol.c | 21 +++++++++++++++------ 2 files changed, 15 insertions(+), 8 deletions(-)
diff --git a/mm/backing-dev.c b/mm/backing-dev.c index 45ac57fd6e7a..1ae2b74cbad8 100644 --- a/mm/backing-dev.c +++ b/mm/backing-dev.c @@ -1121,8 +1121,6 @@ void wb_attach_memcg_to_blkcg(struct cgroup_subsys_state *memcg_css, if (!cgroup1_writeback) return;
- lockdep_assert_held(&cgroup_mutex); - css_get(blkcg_css); memcg->wb_blk_css = blkcg_css; if (pre_blkcss == NULL) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 3e9e93fcb715..ffb6b3e37733 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5358,15 +5358,22 @@ static int wb_blkio_show(struct seq_file *m, void *v) if (!path) return -ENOMEM;
- mutex_lock(&cgroup_mutex); + rcu_read_lock(); blkcg_css = memcg->wb_blk_css; + if (!css_tryget_online(blkcg_css)) { + kfree(path); + rcu_read_unlock(); + + return -EINVAL; + } blkcg_cgroup = blkcg_css->cgroup; blkcg_id = cgroup_ino(blkcg_cgroup); cgroup_path(blkcg_cgroup, path, PATH_MAX); - mutex_unlock(&cgroup_mutex); seq_printf(m, "wb_blkio_path:%s\n", path); seq_printf(m, "wb_blkio_ino:%lu\n", blkcg_id); kfree(path); + css_put(blkcg_css); + rcu_read_unlock();
return 0; } @@ -5389,22 +5396,24 @@ static ssize_t wb_blkio_write(struct kernfs_open_file *of, char *buf, if (ret) return ret;
- mutex_lock(&cgroup_mutex); + rcu_read_lock(); root = blkcg_root_css->cgroup->root; blk_cgroup = cgroup1_get_from_id(root, cgrp_id); if (IS_ERR(blk_cgroup)) { - mutex_unlock(&cgroup_mutex); + rcu_read_unlock(); return -EINVAL; } blkcg_css = cgroup_tryget_css(blk_cgroup, &io_cgrp_subsys); - if (!blkcg_css) + if (!blkcg_css) { + ret = -EINVAL; goto out_unlock; + } wb_attach_memcg_to_blkcg(memcg_css, blkcg_css); css_put(blkcg_css);
out_unlock: cgroup_put(blk_cgroup); - mutex_unlock(&cgroup_mutex); + rcu_read_unlock();
return ret < 0 ? ret : nbytes; }