Re: [PATCH] cgroup: Fix potential race between cgroup_exit and migrate path

From: Neeraj Upadhyay
Date: Mon Sep 04 2017 - 09:23:35 EST




On 08/31/2017 06:42 AM, Tejun Heo wrote:
On Wed, Aug 30, 2017 at 06:03:19PM -0700, Tejun Heo wrote:
Oops, more like the following.

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index df2e0f1..6f34025 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -683,7 +683,7 @@ static void css_set_move_task(struct task_struct *task,
if (it->task_pos == &task->cg_list)
css_task_iter_advance(it);
- list_del_init(&task->cg_list);
+ list_del(&task->cg_list);
if (!css_set_populated(from_cset))
css_set_update_populated(from_cset, false);
} else {
@@ -702,6 +702,8 @@ static void css_set_move_task(struct task_struct *task,
rcu_assign_pointer(task->cgroups, to_cset);
list_add_tail(&task->cg_list, use_mg_tasks ? &to_cset->mg_tasks :
&to_cset->tasks);
+ } else {
+ INIT_LIST_HEAD(&task->cg_list);
}
}
On the third thought, I don't think this can happen either because now
migration is strongly synchronized against exits. Please take a look
at the changes around cgroup_threadgroup_rwsem.

Thanks.

Thank you for the suggestion; found below fix, which is not present in v4.4.86
stable code base. Please let me know in case I am missing something:

eedd0f4 cgroupns: Close race between cgroup_post_fork and copy_cgroup_ns

Thanks.

--
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member of the Code Aurora Forum, hosted by The Linux Foundation