Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org 4B48F60241
Subject: Re: [PATCH] percpu_counter: Remove debug_object_free call twice
From:   "Kohli, Gaurav" <gkohli@codeaurora.org>
To:     Tejun Heo <tj@kernel.org>
Cc:     gregkh@linuxfoundation.org, nborisov@suse.com,
        akpm@linux-foundation.org, linux-arm-msm@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <1523612103-15071-1-git-send-email-gkohli@codeaurora.org>
 <20180416214810.GF1911913@devbig577.frc2.facebook.com>
 <a9ef4575-bfb9-c854-ea71-0a5e1af97f5d@codeaurora.org>
Message-ID: <5703acbf-da53-7409-7d73-f48e580ce1cd@codeaurora.org>
Date:   Mon, 27 Aug 2018 12:26:32 +0530
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101
 Thunderbird/52.9.1
MIME-Version: 1.0
In-Reply-To: <a9ef4575-bfb9-c854-ea71-0a5e1af97f5d@codeaurora.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi ,

Sorry for very late reminder, just wanted to know is below understanding 
of code is wrong?

Regards
Gaurav

On 4/17/2018 11:59 AM, Kohli, Gaurav wrote:
> On 4/17/2018 3:18 AM, Tejun Heo wrote:
> 
>> On Fri, Apr 13, 2018 at 03:05:03PM +0530, Gaurav Kohli wrote:
>>> During percpu_counter destroy, debug_object_free is calling
>>> twice which may create race. So removing once instance of call
>>> from debug_percpu_counter_deactivate.
>> I don't quite follow.  Can you please elaborate how it can be called
>> twice?
> 
> Hi Tejun,
> 
> In percpu_counter_fixup_free function, first call is 
> percpu_counter_destroy -> debug_percpu_counter_deactivate (this will set 
> inactive and free the debug object as well for percpu counter) -> 
> free_percpu (finally freeing the counters).
> 
> Below is the code snippet:
> 
>          case DEBUG_STATE_ACTIVE:
> 
>                  percpu_counter_destroy(fbc); -> first call
> 
>                  debug_object_free(fbc, &percpu_counter_debug_descr); -> 
> this will again call the same debug object free, if somehow counters 
> will reinitialize between these two calls.
> 
> 
> We are seeing one race condition issue where one object of db list is 
> corrupted and just before object of that corrupted node is 
> percpu_counter, Still i am not sure the reason of race as it is very
> 
> difficult to reproduce. But i have found this during code review. Please 
> correct me, if i misunderstood this.
> 
>>
>> Thanks.
>>
>>

-- 
Qualcomm India Private Limited, on behalf of Qualcomm Innovation Center, 
Inc. is a member of the Code Aurora Forum,
a Linux Foundation Collaborative Project.