Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9732adc5 authored by Zefan Li's avatar Zefan Li Committed by Tejun Heo
Browse files

cgroup: avoid attaching a cgroup root to two different superblocks, take 2 



Commit bfb0b80d ("cgroup: avoid attaching a cgroup root to two
different superblocks") is broken.  Now we try to fix the race by
delaying the initialization of cgroup root refcnt until a superblock
has been allocated.

Reported-by: default avatarDmitry Vyukov <dvyukov@google.com>
Reported-by: default avatarAndrei Vagin <avagin@virtuozzo.com>
Tested-by: default avatarAndrei Vagin <avagin@virtuozzo.com>
Signed-off-by: default avatarZefan Li <lizefan@huawei.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent a590b90d

kernel/cgroup/cgroup-internal.h

+1 −1
Original line number Diff line number Diff line
@@ -164,7 +164,7 @@ int cgroup_path_ns_locked(struct cgroup *cgrp, char *buf, size_t buflen, 


void cgroup_free_root(struct cgroup_root *root);

void init_cgroup_root(struct cgroup_root *root, struct cgroup_sb_opts *opts);

int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask);

int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask, int ref_flags);

int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask);

struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags,

			       struct cgroup_root *root, unsigned long magic,

kernel/cgroup/cgroup-v1.c

+15 −1
Original line number Diff line number Diff line
@@ -1072,6 +1072,7 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags, 
	struct cgroup_subsys *ss;

	struct dentry *dentry;

	int i, ret;

	bool new_root = false;



	cgroup_lock_and_drain_offline(&cgrp_dfl_root.cgrp);
@@ -1181,10 +1182,11 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags, 
		ret = -ENOMEM;

		goto out_unlock;

	}

	new_root = true;



	init_cgroup_root(root, &opts);



	ret = cgroup_setup_root(root, opts.subsys_mask);

	ret = cgroup_setup_root(root, opts.subsys_mask, PERCPU_REF_INIT_DEAD);

	if (ret)

		cgroup_free_root(root);
@@ -1200,6 +1202,18 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags, 
	dentry = cgroup_do_mount(&cgroup_fs_type, flags, root,

				 CGROUP_SUPER_MAGIC, ns);



	/*

	 * There's a race window after we release cgroup_mutex and before

	 * allocating a superblock. Make sure a concurrent process won't

	 * be able to re-use the root during this window by delaying the

	 * initialization of root refcnt.

	 */

	if (new_root) {

		mutex_lock(&cgroup_mutex);

		percpu_ref_reinit(&root->cgrp.self.refcnt);

		mutex_unlock(&cgroup_mutex);

	}



	/*

	 * If @pinned_sb, we're reusing an existing root and holding an

	 * extra ref on its sb.  Mount is complete.  Put the extra ref.

kernel/cgroup/cgroup.c

+4 −4
Original line number Diff line number Diff line
@@ -1645,7 +1645,7 @@ void init_cgroup_root(struct cgroup_root *root, struct cgroup_sb_opts *opts) 
		set_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->cgrp.flags);

}



int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)

int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask, int ref_flags)

{

	LIST_HEAD(tmp_links);

	struct cgroup *root_cgrp = &root->cgrp;
@@ -1661,8 +1661,8 @@ int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask) 
	root_cgrp->id = ret;

	root_cgrp->ancestor_ids[0] = ret;



	ret = percpu_ref_init(&root_cgrp->self.refcnt, css_release, 0,

			      GFP_KERNEL);

	ret = percpu_ref_init(&root_cgrp->self.refcnt, css_release,

			      ref_flags, GFP_KERNEL);

	if (ret)

		goto out;
@@ -4517,7 +4517,7 @@ int __init cgroup_init(void) 
	hash_add(css_set_table, &init_css_set.hlist,

		 css_set_hash(init_css_set.subsys));



	BUG_ON(cgroup_setup_root(&cgrp_dfl_root, 0));

	BUG_ON(cgroup_setup_root(&cgrp_dfl_root, 0, 0));



	mutex_unlock(&cgroup_mutex);