Commit ed815679 authored Jul 15, 2016 by Eric W. Biederman Committed by ivanmeler Oct 08, 2021

cgroupns: Close race between cgroup_post_fork and copy_cgroup_ns



In most code paths involving cgroup migration cgroup_threadgroup_rwsem
is taken.  There are two exceptions:

- remove_tasks_in_empty_cpuset calls cgroup_transfer_tasks
- vhost_attach_cgroups_work calls cgroup_attach_task_all

With cgroup_threadgroup_rwsem held it is guaranteed that cgroup_post_fork
and copy_cgroup_ns will reference the same css_set from the process calling
fork.

Without such an interlock there process after fork could reference one
css_set from it's new cgroup namespace and another css_set from
task->cgroups, which semantically is nonsensical.

Change-Id: Iadec82bd07a43bf7cefcf8fc17603700fd4895c3
Cc: stable@vger.kernel.org
Fixes: a79a908fd2b0 ("cgroup: introduce cgroup namespaces")
Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Git-commit: eedd0f4cbf5f3b81e82649832091e1d9d53f0709
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git


Signed-off-by: Neeraj Upadhyay <neeraju@codeaurora.org>

parent 7aae4db5

kernel/cgroup.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -2799,6 +2799,7 @@ int cgroup_attach_task_all(struct task_struct from, struct task_struct tsk)
		int retval = 0;

		mutex_lock(&cgroup_mutex);
		percpu_down_write(&cgroup_threadgroup_rwsem);
		for_each_root(root) {
		struct cgroup *from_cgrp;

		@@ -2813,6 +2814,7 @@ int cgroup_attach_task_all(struct task_struct from, struct task_struct tsk)
		if (retval)
		break;
		}
		percpu_up_write(&cgroup_threadgroup_rwsem);
		mutex_unlock(&cgroup_mutex);

		return retval;
		@@ -4072,6 +4074,8 @@ int cgroup_transfer_tasks(struct cgroup to, struct cgroup from)

		mutex_lock(&cgroup_mutex);

		percpu_down_write(&cgroup_threadgroup_rwsem);

		/* all tasks in @from are being moved, all csets are source */
		spin_lock_irq(&css_set_lock);
		list_for_each_entry(link, &from->cset_links, cset_link)
		@@ -4100,6 +4104,7 @@ int cgroup_transfer_tasks(struct cgroup to, struct cgroup from)
		} while (task && !ret);
		out_err:
		cgroup_migrate_finish(&preloaded_csets);
		percpu_up_write(&cgroup_threadgroup_rwsem);
		mutex_unlock(&cgroup_mutex);
		return ret;
		}