Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753860AbbDQVrC (ORCPT ); Fri, 17 Apr 2015 17:47:02 -0400 Received: from mail-ig0-f169.google.com ([209.85.213.169]:37176 "EHLO mail-ig0-f169.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752932AbbDQVq6 (ORCPT ); Fri, 17 Apr 2015 17:46:58 -0400 Message-ID: <1429307216.7346.255.camel@edumazet-glaptop2.roam.corp.google.com> Subject: Re: [RFC PATCH] fs: use a sequence counter instead of file_lock in fd_install From: Eric Dumazet To: Mateusz Guzik Cc: Alexander Viro , Andrew Morton , "Paul E. McKenney" , Yann Droneaud , Konstantin Khlebnikov , linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Date: Fri, 17 Apr 2015 14:46:56 -0700 In-Reply-To: <20150416121628.GA20615@mguzik> References: <20150416121628.GA20615@mguzik> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.10.4-0ubuntu2 Mime-Version: 1.0 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1638 Lines: 59 On Thu, 2015-04-16 at 14:16 +0200, Mateusz Guzik wrote: > Hi, > > Currently obtaining a new file descriptor results in locking fdtable > twice - once in order to reserve a slot and second time to fill it ... > void __fd_install(struct files_struct *files, unsigned int fd, > struct file *file) > { > + unsigned long seq; unsigned int seq; > struct fdtable *fdt; > - spin_lock(&files->file_lock); > - fdt = files_fdtable(files); > - BUG_ON(fdt->fd[fd] != NULL); > - rcu_assign_pointer(fdt->fd[fd], file); > - spin_unlock(&files->file_lock); > + > + rcu_read_lock(); > + do { > + seq = read_seqcount_begin(&files->fdt_seqcount); > + fdt = files_fdtable_seq(files); > + /* > + * Entry in the table can already be equal to file if we > + * had to restart and copy_fdtable picked up our update. > + */ > + BUG_ON(!(fdt->fd[fd] == NULL || fdt->fd[fd] == file)); > + rcu_assign_pointer(fdt->fd[fd], file); > + smp_mb(); > + } while (__read_seqcount_retry(&files->fdt_seqcount, seq)); > + rcu_read_unlock(); > } > So one problem here is : As soon as rcu_assign_pointer(fdt->fd[fd], file) is done, and other cpu does one expand_fdtable() and releases files->file_lock, another cpu can close(fd). Then another cpu can reuse the [fd] now empty slot and install a new file in it. Then this cpu will crash here : BUG_ON(!(fdt->fd[fd] == NULL || fdt->fd[fd] == file)); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/