Messages in this thread | | | Date | Thu, 28 Mar 2019 15:26:19 +0100 | From | Oleg Nesterov <> | Subject | Re: [PATCH] Convert struct pid count to refcount_t |
| |
On 03/27, Joel Fernandes wrote: > > Also, based on Kees comment, I think it appears to me that get_pid and > put_pid can race in this way in the original code right? > > get_pid put_pid > > atomic_dec_and_test returns 1 > atomic_inc > kfree > > deref pid /* boom */ > ------------------------------------------------- > > I think get_pid needs to call atomic_inc_not_zero()
No.
get_pid() should only be used if you already have a reference or you do something like
rcu_read_lock(); pid = find_vpid(); get_pid(); rcu_read_lock();
in this case we rely on call_rcu(delayed_put_pid) which drops the initial reference.
If put_pid() sees pid->count == 1, then a) nobody else has a reference and b) nobody else can find this pid on rcu-protected lists, so it is safe to free it.
Oleg.
| |