2014-01-06 21:18:54

by Kent Overstreet

Subject: [PATCH] percpu-refcount: Add a WARN() for ref going negative

AIO had a missing get, which led to an ioctx leak - after percpu_ref_kill() the
ref was 0 so percpu_ref_put() never saw it hit 0.

This wasn't noticed at the time because it all happened completely silently,
this adds a WARN() which would've caught the aio bug.

Signed-off-by: Kent Overstreet <[email protected]>
Cc: Tejun Heo <[email protected]>
---
lib/percpu-refcount.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/lib/percpu-refcount.c b/lib/percpu-refcount.c
index 1a53d497a8..32538f12f8 100644
--- a/lib/percpu-refcount.c
+++ b/lib/percpu-refcount.c
@@ -120,6 +120,9 @@ static void percpu_ref_kill_rcu(struct rcu_head *rcu)

atomic_add((int) count - PCPU_COUNT_BIAS, &ref->count);

+ WARN(atomic_read(&ref->count) <= 0,
+ "percpu ref <= 0 (%i)", atomic_read(&ref->count));
+
/* @ref is viewed as dead on all CPUs, send out kill confirmation */
if (ref->confirm_kill)
ref->confirm_kill(ref);
--
1.8.5.2

2014-01-12 03:36:06

by Tejun Heo

Subject: Re: [PATCH] percpu-refcount: Add a WARN() for ref going negative

On Mon, Jan 06, 2014 at 01:13:26PM -0800, Kent Overstreet wrote:
> AIO had a missing get, which led to an ioctx leak - after percpu_ref_kill() the
> ref was 0 so percpu_ref_put() never saw it hit 0.
>
> This wasn't noticed at the time because it all happened completely silently,
> this adds a WARN() which would've caught the aio bug.
>
> Signed-off-by: Kent Overstreet <[email protected]>
> Cc: Tejun Heo <[email protected]>

Applied to percpu/for-3.14 w/ WARN_ONCE() instead WARN().

Thanks.

--
tejun