Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 068c5cc5 authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Ingo Molnar
Browse files

sched, cgroup: Use exit hook to avoid use-after-free crash 



By not notifying the controller of the on-exit move back to
init_css_set, we fail to move the task out of the previous
cgroup's cfs_rq. This leads to an opportunity for a
cgroup-destroy to come in and free the cgroup (there are no
active tasks left in it after all) to which the not-quite dead
task is still enqueued.

Reported-by: default avatarMiklos Vajna <vmiklos@frugalware.org>
Fixed-by: default avatarMike Galbraith <efault@gmx.de>
Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
Cc: <stable@kernel.org>
Cc: Mike Galbraith <efault@gmx.de>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
LKML-Reference: <1293206353.29444.205.camel@laptop>
parent d7d82944

kernel/sched.c

+18 −0
Original line number Original line Diff line number Diff line
@@ -606,6 +606,9 @@ static inline struct task_group *task_group(struct task_struct *p) 
	struct task_group *tg;

	struct task_group *tg;

	struct cgroup_subsys_state *css;

	struct cgroup_subsys_state *css;





	if (p->flags & PF_EXITING)

		return &root_task_group;



	css = task_subsys_state_check(p, cpu_cgroup_subsys_id,

	css = task_subsys_state_check(p, cpu_cgroup_subsys_id,

			lockdep_is_held(&task_rq(p)->lock));

			lockdep_is_held(&task_rq(p)->lock));

	tg = container_of(css, struct task_group, css);

	tg = container_of(css, struct task_group, css);
@@ -8880,6 +8883,20 @@ cpu_cgroup_attach(struct cgroup_subsys *ss, struct cgroup *cgrp, 
	}

	}

}

}





static void

cpu_cgroup_exit(struct cgroup_subsys *ss, struct task_struct *task)

{

	/*

	 * cgroup_exit() is called in the copy_process() failure path.

	 * Ignore this case since the task hasn't ran yet, this avoids

	 * trying to poke a half freed task state from generic code.

	 */

	if (!(task->flags & PF_EXITING))

		return;



	sched_move_task(task);

}



#ifdef CONFIG_FAIR_GROUP_SCHED

#ifdef CONFIG_FAIR_GROUP_SCHED

static int cpu_shares_write_u64(struct cgroup *cgrp, struct cftype *cftype,

static int cpu_shares_write_u64(struct cgroup *cgrp, struct cftype *cftype,

				u64 shareval)

				u64 shareval)
@@ -8952,6 +8969,7 @@ struct cgroup_subsys cpu_cgroup_subsys = { 
	.destroy	= cpu_cgroup_destroy,

	.destroy	= cpu_cgroup_destroy,

	.can_attach	= cpu_cgroup_can_attach,

	.can_attach	= cpu_cgroup_can_attach,

	.attach		= cpu_cgroup_attach,

	.attach		= cpu_cgroup_attach,

	.exit		= cpu_cgroup_exit,

	.populate	= cpu_cgroup_populate,

	.populate	= cpu_cgroup_populate,

	.subsys_id	= cpu_cgroup_subsys_id,

	.subsys_id	= cpu_cgroup_subsys_id,

	.early_init	= 1,

	.early_init	= 1,