| Message ID | 1454338315-13465-2-git-send-email-roman.penyaev@profitbricks.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On 01.02.2016 15:51, Roman Pen wrote: > get_disk(),get_gendisk() calls have non explicit side effect: they > increase the reference on the disk owner module. > > The following is the correct sequence how to get a disk reference and > to put it: > > disk = get_gendisk(...); > > /* use disk */ > > owner = disk->fops->owner; > put_disk(disk); > module_put(owner); > > fs/block_dev.c is aware of this required module_put() call, but f.e. > blkg_conf_finish(), which is located in block/blk-cgroup.c, does not put > a module reference. To see a leakage in action cgroups throttle config > can be used. In the following script I'm removing throttle for /dev/ram0 > (actually this is NOP, because throttle was never set for this device): > > # lsmod | grep brd > brd 5175 0 > # i=100; while [ $i -gt 0 ]; do echo "1:0 0" > \ > /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device; i=$(($i - 1)); \ > done > # lsmod | grep brd > brd 5175 100 > > Now brd module has 100 references. I hope this patch would be merged into stable versions. I've tested the patch with v3.12.45 on my server. Before apply the patch, reference count was leaked. # lsmod | grep loop loop 16091 0 # echo "7:0 1048576" > /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device # lsmod | grep loop loop 16091 1 # echo "7:0 1048576" > /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device # lsmod | grep loop loop 16091 2 # echo "7:0 1048576" > /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device # lsmod | grep loop loop 16091 3 # echo "7:0 1048576" > /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device # lsmod | grep loop loop 16091 4 After apply the patch, reference count was still: # lsmod | grep loop loop 19171 0 # echo "7:0 1048576" > /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device # lsmod | grep loop loop 19171 0 # echo "7:0 1048576" > /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device # lsmod | grep loop loop 19171 0 # echo "7:0 1048576" > /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device # lsmod | grep loop loop 19171 0
diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 5a37188..66e6f1a 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -788,6 +788,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, { struct gendisk *disk; struct blkcg_gq *blkg; + struct module *owner; unsigned int major, minor; int key_len, part, ret; char *body; @@ -804,7 +805,9 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, if (!disk) return -ENODEV; if (part) { + owner = disk->fops->owner; put_disk(disk); + module_put(owner); return -ENODEV; } @@ -820,7 +823,9 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, ret = PTR_ERR(blkg); rcu_read_unlock(); spin_unlock_irq(disk->queue->queue_lock); + owner = disk->fops->owner; put_disk(disk); + module_put(owner); /* * If queue was bypassing, we should retry. Do so after a * short msleep(). It isn't strictly necessary but queue @@ -851,9 +856,13 @@ EXPORT_SYMBOL_GPL(blkg_conf_prep); void blkg_conf_finish(struct blkg_conf_ctx *ctx) __releases(ctx->disk->queue->queue_lock) __releases(rcu) { + struct module *owner; + spin_unlock_irq(ctx->disk->queue->queue_lock); rcu_read_unlock(); + owner = ctx->disk->fops->owner; put_disk(ctx->disk); + module_put(owner); } EXPORT_SYMBOL_GPL(blkg_conf_finish);
get_disk(),get_gendisk() calls have non explicit side effect: they increase the reference on the disk owner module. The following is the correct sequence how to get a disk reference and to put it: disk = get_gendisk(...); /* use disk */ owner = disk->fops->owner; put_disk(disk); module_put(owner); fs/block_dev.c is aware of this required module_put() call, but f.e. blkg_conf_finish(), which is located in block/blk-cgroup.c, does not put a module reference. To see a leakage in action cgroups throttle config can be used. In the following script I'm removing throttle for /dev/ram0 (actually this is NOP, because throttle was never set for this device): # lsmod | grep brd brd 5175 0 # i=100; while [ $i -gt 0 ]; do echo "1:0 0" > \ /sys/fs/cgroup/blkio/blkio.throttle.read_bps_device; i=$(($i - 1)); \ done # lsmod | grep brd brd 5175 100 Now brd module has 100 references. The issue is fixed by calling module_put() just right away put_disk(). Signed-off-by: Roman Pen <roman.penyaev@profitbricks.com> Cc: Gi-Oh Kim <gi-oh.kim@profitbricks.com> Cc: Tejun Heo <tj@kernel.org> Cc: Jens Axboe <axboe@kernel.dk> Cc: linux-block@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- block/blk-cgroup.c | 9 +++++++++ 1 file changed, 9 insertions(+)