Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8e3bbf42 authored by Salman Qazi's avatar Salman Qazi Committed by Tejun Heo
Browse files

cgroups: Account for CSS_DEACT_BIAS in __css_put 



When we fixed the race between atomic_dec and css_refcnt, we missed
the fact that css_refcnt internally subtracts CSS_DEACT_BIAS to get
the actual reference count.  This can potentially cause a refcount leak
if __css_put races with cgroup_clear_css_refs.

Signed-off-by: default avatarSalman Qazi <sqazi@google.com>
Acked-by: default avatarLi Zefan <lizefan@huawei.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent 967db0ea

kernel/cgroup.c

+10 −2
Original line number Diff line number Diff line
@@ -255,12 +255,17 @@ int cgroup_lock_is_held(void) 


EXPORT_SYMBOL_GPL(cgroup_lock_is_held);



static int css_unbias_refcnt(int refcnt)

{

	return refcnt >= 0 ? refcnt : refcnt - CSS_DEACT_BIAS;

}



/* the current nr of refs, always >= 0 whether @css is deactivated or not */

static int css_refcnt(struct cgroup_subsys_state *css)

{

	int v = atomic_read(&css->refcnt);



	return v >= 0 ? v : v - CSS_DEACT_BIAS;

	return css_unbias_refcnt(v);

}



/* convenient tests for these bits */
@@ -4982,9 +4987,12 @@ EXPORT_SYMBOL_GPL(__css_tryget); 
void __css_put(struct cgroup_subsys_state *css)

{

	struct cgroup *cgrp = css->cgroup;

	int v;



	rcu_read_lock();

	switch (atomic_dec_return(&css->refcnt)) {

	v = css_unbias_refcnt(atomic_dec_return(&css->refcnt));



	switch (v) {

	case 1:

		if (notify_on_release(cgrp)) {

			set_bit(CGRP_RELEASABLE, &cgrp->flags);