kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

cgroup: make sure that decisions in __css_put are atomic

Browse source 
__css_put is using atomic_dec on the ref count, and then
looking at the ref count to make decisions.  This is prone
to races, as someone else may decrement ref count between
our decrement and our decision.  Instead, we should base our
decisions on the value that we decremented the ref count to.

(This results in an actual race on Google's kernel which I
haven't been able to reproduce on the upstream kernel.  Having
said that, it's still incorrect by inspection).

Signed-off-by: Salman Qazi <sqazi@google.com>
Acked-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
This commit is contained in:
Salman Qazi 2012-06-06 18:51:35 -07:00 committed by Tejun Heo
parent 71fae7e714
commit 967db0ea65
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
kernel/cgroup.c
View file

@ -4984,8 +4984,7 @@ void __css_put(struct cgroup_subsys_state *css)
struct cgroup *cgrp = css->cgroup;
rcu_read_lock();
atomic_dec(&css->refcnt);
switch (css_refcnt(css)) {
switch (atomic_dec_return(&css->refcnt)) {
case 1:
if (notify_on_release(cgrp)) {
set_bit(CGRP_RELEASABLE, &cgrp->flags);