Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ce523995 authored by Aleksa Sarai's avatar Aleksa Sarai Committed by Tejun Heo
Browse files

cgroup: pids: fix invalid get/put usage 



Fix incorrect usage of css_get and css_put to put a different css in
pids_{cancel_,}attach() than the one grabbed in pids_can_attach(). This
could lead to quite serious memory leakage (and unsafe operations on the
putted css).

tj: minor comment update

Signed-off-by: default avatarAleksa Sarai <cyphar@cyphar.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent cf780b7d

kernel/cgroup_pids.c

+4 −15
Original line number Diff line number Diff line
@@ -173,11 +173,11 @@ static int pids_can_attach(struct cgroup_subsys_state *css, 
		struct pids_cgroup *old_pids;



		/*

		 * Grab a ref to each task's css. We don't drop the ref until

		 * we either fail and hit ->cancel_attach() or succeed and hit

		 * ->attach().

		 * No need to pin @old_css between here and cancel_attach()

		 * because cgroup core protects it from being freed before

		 * the migration completes or fails.

		 */

		old_css = task_get_css(task, pids_cgrp_id);

		old_css = task_css(task, pids_cgrp_id);

		old_pids = css_pids(old_css);



		pids_charge(pids, 1);
@@ -202,19 +202,9 @@ static void pids_cancel_attach(struct cgroup_subsys_state *css, 


		pids_charge(old_pids, 1);

		pids_uncharge(pids, 1);

		css_put(old_css);

	}

}



static void pids_attach(struct cgroup_subsys_state *css,

			struct cgroup_taskset *tset)

{

	struct task_struct *task;



	cgroup_taskset_for_each(task, tset)

		css_put(task_css(task, pids_cgrp_id));

}



static int pids_can_fork(struct task_struct *task, void **priv_p)

{

	struct cgroup_subsys_state *css;
@@ -354,7 +344,6 @@ static struct cftype pids_files[] = { 
struct cgroup_subsys pids_cgrp_subsys = {

	.css_alloc	= pids_css_alloc,

	.css_free	= pids_css_free,

	.attach		= pids_attach,

	.can_attach 	= pids_can_attach,

	.cancel_attach 	= pids_cancel_attach,

	.can_fork	= pids_can_fork,