Commit 71b5707e authored Jan 24, 2013 by Li Zefan Committed by Tejun Heo Feb 18, 2013

cgroup: fix exit() vs rmdir() race



In cgroup_exit() put_css_set_taskexit() is called without any lock,
which might lead to accessing a freed cgroup:

thread1                           thread2
---------------------------------------------
exit()
  cgroup_exit()
    put_css_set_taskexit()
      atomic_dec(cgrp->count);
                                   rmdir();
      /* not safe !! */
      check_for_release(cgrp);

rcu_read_lock() can be used to make sure the cgroup is alive.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org

parent 9ed8a659

kernel/cgroup.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -422,12 +422,20 @@ static void __put_css_set(struct css_set *cg, int taskexit)
		struct cgroup *cgrp = link->cgrp;
		list_del(&link->cg_link_list);
		list_del(&link->cgrp_link_list);

		/*
		* We may not be holding cgroup_mutex, and if cgrp->count is
		* dropped to 0 the cgroup can be destroyed at any time, hence
		* rcu_read_lock is used to keep it alive.
		*/
		rcu_read_lock();
		if (atomic_dec_and_test(&cgrp->count) &&
		notify_on_release(cgrp)) {
		if (taskexit)
		set_bit(CGRP_RELEASABLE, &cgrp->flags);
		check_for_release(cgrp);
		}
		rcu_read_unlock();

		kfree(link);
		}