cgroup: fix exit() vs rmdir() race
authorLi Zefan <lizefan@huawei.com>
Thu, 24 Jan 2013 06:43:28 +0000 (14:43 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sun, 3 Mar 2013 22:06:44 +0000 (06:06 +0800)
commit916b6c67cd471fafa3e5e53ce8389c36749ed6f1
tree72cc7d232c2d88d38d5475da41c7ae49826649f7
parenta74e9a386f6e775f88061f7958b8b34c6742f926
cgroup: fix exit() vs rmdir() race

commit 71b5707e119653039e6e95213f00479668c79b75 upstream.

In cgroup_exit() put_css_set_taskexit() is called without any lock,
which might lead to accessing a freed cgroup:

thread1                           thread2
---------------------------------------------
exit()
  cgroup_exit()
    put_css_set_taskexit()
      atomic_dec(cgrp->count);
                                   rmdir();
      /* not safe !! */
      check_for_release(cgrp);

rcu_read_lock() can be used to make sure the cgroup is alive.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernel/cgroup.c