Re: [PATCH v2] ocfs2/cluster: unlink socket containers before releasing resources

[Andrew Morton]

On Wed, 14 Oct 2026 10:17:57 +0800 Joseph Qi <joseph.qi@xxxxxxxxxxxxxxxxx> wrote:

> 
> 
> On 10/13/26 11:34 PM, Cen Zhang wrote:
> > A socket container's node and socket must remain alive while the
> > container is on sock_containers. The debugfs formatter reads sc_node
> > and sc_sock under o2net_debug_lock without taking their references, but
> > sc_kref_release() releases both before taking that lock to unlink the
> > container.
> > 
> > With CONFIG_DEBUG_FS enabled, a synchronous sender can retain its last
> > socket-container reference after o2net_disconnect_node() has detached
> > the connection and flushed o2net_wq. The caller runs outside that
> > workqueue. After the sender removes its configfs dependency, node
> > removal can proceed without waiting for the sender's final sc_put():
> > 
> >   Sender (final sc_put)    Configfs rmdir        Debugfs reader
> >   --------------------    --------------        --------------
> >   o2nm_undepend_item()
> >                           Drop node item refs
> >   o2nm_node_put()
> >     [node can be freed]
> >                                                sc_seq_show()
> >                                                  Lock debug lock
> >                                                  Read sc_node->nd_name
> >                                                  Unlock debug lock
> >   sc_node = NULL
> >   o2net_debug_del_sc()
> > 
> > The earlier socket release has a similar window. The container is
> > still selectable while its socket has been released and sc_sock has
> > not yet been cleared:
> > 
> >   Sender (final sc_put)                       Debugfs reader
> >   --------------------                       --------------
> >   sock_release(sc->sc_sock)
> >     [socket can be freed]
> >                                              sc_seq_show()
> >                                                Lock debug lock
> >                                                Read sc_sock->sk fields
> >                                                Unlock debug lock
> >   sc_sock = NULL
> >   ...
> >   o2net_debug_del_sc()
> > 
> > Move o2net_debug_del_sc() before releasing either resource. Unlinking
> > under the existing debug lock waits for an active formatter to finish
> > and prevents later readers from selecting the container. This covers
> > both socket fields and node fields, including nd_num in the stats
> > formatter. Release the debug lock before the existing resource cleanup.
> 
> sc_kref_release() never holds o2net_debug_lock, the lock is taken and
> dropped inside the helper o2net_debug_del_sc().
> 
> So better to:
> 
> s/ Release the debug lock before the existing resource cleanup.//

I made that edit, thanks.