Re: Possible race between cgroup_attach_proc and de_thread, andquestionable code in de_thread.

From: NeilBrown
Date: Sun Aug 14 2011 - 19:58:55 EST

On Sun, 14 Aug 2011 19:51:19 +0200 Oleg Nesterov <oleg@xxxxxxxxxx> wrote:

> On 07/28, Paul E. McKenney wrote:
> >
> > On Thu, Jul 28, 2011 at 11:08:13AM +1000, NeilBrown wrote:
> > >
> > > I disagree. It also requires - by virtue of the use of while_each_thread() -
> > > that 'g' remains on the list that 't' is walking along.
> >
> > Doesn't the following code in the loop body deal with this possibilty?
> >
> > /* Exit if t or g was unhashed during refresh. */
> > if (t->state == TASK_DEAD || g->state == TASK_DEAD)
> > goto unlock;
> This code is completely wrong even if while_each_thread() was fine.
> I sent the patch but it was ignored.
> [PATCH] fix the racy check_hung_uninterruptible_tasks()->rcu_lock_break()
> Oleg.

I agree with that patch.
RCU only protects a task_struct until release_task() is called (which
removes it from the task list).

So holding rcu_lock doesn't stop put_task_struct from freeing the memory
unless we *know* that release_task hasn't been called. This is exactly that
pid_alive() tests.

I must say that handling of task_struct seems to violate the law of least
surprise a little to often for my taste. Maybe it is just a difficult
problem and it needs a complex solution - but it would be really nice if it
were a bit simpler :-(

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at
Please read the FAQ at