Re: [PATCH] fs/namespace: don't clobber mnt_hash.next while umounting [v2]

2014-03-19 Thread Linus Torvalds
On Wed, Mar 19, 2014 at 9:21 PM, Al Viro wrote: > > Er... I have, actually, right in the part you've snipped ;-) Heh. That's what I get for just reading the patch, and skimming the explanation. > I would prefer to deal with (1) by turning mnt_hash into hlist; the problem > with that is

Re: [PATCH] fs/namespace: don't clobber mnt_hash.next while umounting [v2]

2014-03-19 Thread Al Viro
On Wed, Mar 19, 2014 at 09:02:33PM -0700, Linus Torvalds wrote: > Quite frankly, if that's the main issue, then may I suggest aiming to > use a 'hlist' instead of a doubly-linked list? Those have the > advantage that they are NULL-terminated. > > Yeah, hlists have some disadvantages too, which

Re: [PATCH] fs/namespace: don't clobber mnt_hash.next while umounting [v2]

2014-03-19 Thread Linus Torvalds
On Wed, Mar 19, 2014 at 8:48 PM, Al Viro wrote: > > NAK. Nice catch, the bug is real, but the fix is wrong. For one thing, > you have missed detach_mnt()/attach_mnt(), so you are not covering > all places where the sucker might be removed from the list. For another, > I don't believe that this

Re: [PATCH] fs/namespace: don't clobber mnt_hash.next while umounting [v2]

2014-03-19 Thread Al Viro
On Wed, Mar 19, 2014 at 10:39:45PM +0100, Max Kellermann wrote: > mount.mnt_hash is RCU-protected. However, list_move() breaks RCU > protection: when one thread walks the linked list while another calls > list_move(), it may "redirect" the first thread into the new list, > making it loop

[PATCH] fs/namespace: don't clobber mnt_hash.next while umounting [v2]

2014-03-19 Thread Max Kellermann
mount.mnt_hash is RCU-protected. However, list_move() breaks RCU protection: when one thread walks the linked list while another calls list_move(), it may "redirect" the first thread into the new list, making it loop endlessly in __lookup_mnt(), because the list head is never found. The right

[PATCH] fs/namespace: don't clobber mnt_hash.next while umounting [v2]

2014-03-19 Thread Max Kellermann
mount.mnt_hash is RCU-protected. However, list_move() breaks RCU protection: when one thread walks the linked list while another calls list_move(), it may redirect the first thread into the new list, making it loop endlessly in __lookup_mnt(), because the list head is never found. The right way

Re: [PATCH] fs/namespace: don't clobber mnt_hash.next while umounting [v2]

2014-03-19 Thread Al Viro
On Wed, Mar 19, 2014 at 10:39:45PM +0100, Max Kellermann wrote: mount.mnt_hash is RCU-protected. However, list_move() breaks RCU protection: when one thread walks the linked list while another calls list_move(), it may redirect the first thread into the new list, making it loop endlessly in

Re: [PATCH] fs/namespace: don't clobber mnt_hash.next while umounting [v2]

2014-03-19 Thread Linus Torvalds
On Wed, Mar 19, 2014 at 8:48 PM, Al Viro v...@zeniv.linux.org.uk wrote: NAK. Nice catch, the bug is real, but the fix is wrong. For one thing, you have missed detach_mnt()/attach_mnt(), so you are not covering all places where the sucker might be removed from the list. For another, I don't

Re: [PATCH] fs/namespace: don't clobber mnt_hash.next while umounting [v2]

2014-03-19 Thread Al Viro
On Wed, Mar 19, 2014 at 09:02:33PM -0700, Linus Torvalds wrote: Quite frankly, if that's the main issue, then may I suggest aiming to use a 'hlist' instead of a doubly-linked list? Those have the advantage that they are NULL-terminated. Yeah, hlists have some disadvantages too, which might

Re: [PATCH] fs/namespace: don't clobber mnt_hash.next while umounting [v2]

2014-03-19 Thread Linus Torvalds
On Wed, Mar 19, 2014 at 9:21 PM, Al Viro v...@zeniv.linux.org.uk wrote: Er... I have, actually, right in the part you've snipped ;-) Heh. That's what I get for just reading the patch, and skimming the explanation. I would prefer to deal with (1) by turning mnt_hash into hlist; the problem