Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit eedd0f4c authored by Eric W. Biederman's avatar Eric W. Biederman Committed by Tejun Heo
Browse files

cgroupns: Close race between cgroup_post_fork and copy_cgroup_ns 



In most code paths involving cgroup migration cgroup_threadgroup_rwsem
is taken.  There are two exceptions:

- remove_tasks_in_empty_cpuset calls cgroup_transfer_tasks
- vhost_attach_cgroups_work calls cgroup_attach_task_all

With cgroup_threadgroup_rwsem held it is guaranteed that cgroup_post_fork
and copy_cgroup_ns will reference the same css_set from the process calling
fork.

Without such an interlock there process after fork could reference one
css_set from it's new cgroup namespace and another css_set from
task->cgroups, which semantically is nonsensical.

Cc: stable@vger.kernel.org
Fixes: a79a908f ("cgroup: introduce cgroup namespaces")
Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent 7bd88308

kernel/cgroup.c

+5 −0
Original line number Diff line number Diff line
@@ -2962,6 +2962,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) 
	int retval = 0;



	mutex_lock(&cgroup_mutex);

	percpu_down_write(&cgroup_threadgroup_rwsem);

	for_each_root(root) {

		struct cgroup *from_cgrp;
@@ -2976,6 +2977,7 @@ int cgroup_attach_task_all(struct task_struct *from, struct task_struct *tsk) 
		if (retval)

			break;

	}

	percpu_up_write(&cgroup_threadgroup_rwsem);

	mutex_unlock(&cgroup_mutex);



	return retval;
@@ -4343,6 +4345,8 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) 


	mutex_lock(&cgroup_mutex);



	percpu_down_write(&cgroup_threadgroup_rwsem);



	/* all tasks in @from are being moved, all csets are source */

	spin_lock_irq(&css_set_lock);

	list_for_each_entry(link, &from->cset_links, cset_link)
@@ -4371,6 +4375,7 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) 
	} while (task && !ret);

out_err:

	cgroup_migrate_finish(&preloaded_csets);

	percpu_up_write(&cgroup_threadgroup_rwsem);

	mutex_unlock(&cgroup_mutex);

	return ret;

}