Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7a3bb24f authored by Tejun Heo's avatar Tejun Heo
Browse files

device_cgroup: use css_has_online_children() instead of has_children() 



devcgroup_update_access() wants to know whether there are child
cgroups which are online and visible to userland and has_children()
may return false positive.  Replace it with css_has_online_children().

Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Acked-by: default avatarAristeu Rozanski <aris@redhat.com>
Acked-by: default avatarSerge Hallyn <serge.hallyn@ubuntu.com>
Acked-by: default avatarLi Zefan <lizefan@huawei.com>
parent f3d46500

security/device_cgroup.c

+2 −17
Original line number Diff line number Diff line
@@ -587,21 +587,6 @@ static int propagate_exception(struct dev_cgroup *devcg_root, 
	return rc;

}



static inline bool has_children(struct dev_cgroup *devcgroup)

{

	bool ret;



	/*

	 * FIXME: There may be lingering offline csses and this function

	 * may return %true when there isn't any userland-visible child

	 * which is incorrect for our purposes.

	 */

	rcu_read_lock();

	ret = css_next_child(NULL, &devcgroup->css);

	rcu_read_unlock();

	return ret;

}



/*

 * Modify the exception list using allow/deny rules.

 * CAP_SYS_ADMIN is needed for this.  It's at least separate from CAP_MKNOD
@@ -634,7 +619,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup, 
	case 'a':

		switch (filetype) {

		case DEVCG_ALLOW:

			if (has_children(devcgroup))

			if (css_has_online_children(&devcgroup->css))

				return -EINVAL;



			if (!may_allow_all(parent))
@@ -650,7 +635,7 @@ static int devcgroup_update_access(struct dev_cgroup *devcgroup, 
				return rc;

			break;

		case DEVCG_DENY:

			if (has_children(devcgroup))

			if (css_has_online_children(&devcgroup->css))

				return -EINVAL;



			dev_exception_clean(devcgroup);