Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754572AbaLBSku (ORCPT ); Tue, 2 Dec 2014 13:40:50 -0500 Received: from forward-corp1f.mail.yandex.net ([95.108.130.40]:39132 "EHLO forward-corp1f.mail.yandex.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752442AbaLBSkt (ORCPT ); Tue, 2 Dec 2014 13:40:49 -0500 From: Roman Gushchin To: Tejun Heo Cc: "linux-kernel@vger.kernel.org" , Li Zefan In-Reply-To: <20141202165553.GB10918@htj.dyndns.org> References: <1417193274-20679-1-git-send-email-klamm@yandex-team.ru> <20141202165553.GB10918@htj.dyndns.org> Subject: Re: [PATCH 3.10] cgroup: break infinite loop in __css_tryget() MIME-Version: 1.0 Message-Id: <119181417545645@webcorp02h.yandex-team.ru> X-Mailer: Yamail [ http://yandex.ru ] 5.0 Date: Tue, 02 Dec 2014 21:40:45 +0300 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=koi8-r Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, Tejun! 02.12.2014, 19:56, "Tejun Heo" : > Hello, Roman. > > On Fri, Nov 28, 2014 at 07:47:54PM +0300, Roman Gushchin wrote: >> ?If cgroup_destroy_locked() sets the css refcount to a negative value, >> ?we get an infinite loop in __css_tryget(). >> >> ?In this case css_refcnt() returns modified (non-negative value), so >> ?both (t == v) and (t < 0) conditions are always false. > > I don't follow. ?The count is biased and modified by unbiasing iff the > value is negative. ?Here, @v is the unbiased value and @t is the > verbatim value. ?If @v is different from @t due to unbiasing, @t must > be negative satisfying the second condition and returning NULL, no? Yep. I missed that we compare t with 0 (not v). Thanks! -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/