Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Wed, 17 Apr 2019 12:26:56 -0700
From:   Tejun Heo <tj@kernel.org>
To:     Konstantin Khorenko <khorenko@virtuozzo.com>
Cc:     Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH RFC 1/1] kernfs: keep kernfs node alive for
 __kernfs_remove()
Message-ID: <20190417192656.GE374014@devbig004.ftw2.facebook.com>
References: <20190416155335.14627-1-khorenko@virtuozzo.com>
 <20190416155335.14627-2-khorenko@virtuozzo.com>
 <20190416191727.GD374014@devbig004.ftw2.facebook.com>
 <0469256f-7af9-c9cb-1c64-5d4bebfad095@virtuozzo.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <0469256f-7af9-c9cb-1c64-5d4bebfad095@virtuozzo.com>
User-Agent: Mutt/1.5.21 (2010-09-15)
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hello,

On Wed, Apr 17, 2019 at 04:12:29PM +0000, Konstantin Khorenko wrote:
> i don't know the full scenario unfortunately, but the idea is the following:
> 
> __kernfs_remove() is called under kernfs_mutex and if
>    !(!kn || (kn->parent && RB_EMPTY_NODE(&kn->rb)))
> 
> it assumes that nothing can change while we hold the mutex and
> for each kernfs descendant should have kn->count > 0.
> 
> =====
>          /* deactivate and unlink the subtree node-by-node */
>          do {
>                  pos = kernfs_leftmost_descendant(kn);
> 
>                  /*
>                   * kernfs_drain() drops kernfs_mutex temporarily and @pos's
>                   * base ref could have been put by someone else by the time
>                   * the function returns.  Make sure it doesn't go away
>                   * underneath us.
>                   */
>                  kernfs_get(pos);
> =====
> 
> At the same time kernfs_notify_workfn() can do a kernfs_put() out of kernfs_mutex
> which probably can be the last put and dec kn->count to 0 any moment.

Yeah, but the caller of __kernfs_remove() should be holding the ref,
so I don't see how it'd reach zero.  Also, just putting that one
kernfs_put() inside mutex can't possibly be the right solution given
that the function is allowed to be called from any context.  I think
we need to understand what's going on better before making changes.

Thanks.

-- 
tejun