linux-kernel - Re: BUG: CGROUPS [2.6.28-rc6] Task migration does not clean reference to group

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 02 Dec 2008 21:07:46 +0800
From:	Li Zefan <lizf@...fujitsu.com>
To:	sudhir kumar <imsudhirkumar@...il.com>
CC:	linux-kernel@...r.kernel.org, vatsa@...ux.vnet.ibm.com,
	bharata@...ux.vnet.ibm.com, dhaval@...ux.vnet.ibm.com,
	balbir@...ux.vnet.ibm.com, skumar@...ux.vnet.ibm.com,
	Peter <a.p.zijlstra@...llo.nl>, Paul Menage <menage@...gle.com>,
	mingo@...e.hu
Subject: Re: BUG: CGROUPS [2.6.28-rc6] Task migration does not clean reference
 to group

sudhir kumar wrote:
> Hi,
> I see an interesting bug in the cgroups. I found that cat /proc/cgroups
> does not decrease the num_cgroups field when a group is deleted. It looks
> to me that somewhere we miss to delete the reference, which leads to a failure
> to unmount the cgroups filesystem.

Ah, it's not a bug. :)

> The steps to produce the bug are:
> 
> mkdir /cpu
> mount -t cgroup -ocpu cgroup /cpu
> cd cpu
> mkdir group1;
> cd group1;
> /./while &              # an infinite loop

Seems whenever we create a background job, we'll have a pin to the directory where
the job is created. So though rmdir() removed the directory, the dentry's refcnt
is still >0, so cgroup_diput() in which number_of_cgroups is decreased is not called.
This explains why 'num_cgroups' showed in /proc/cgroups is not 1, and why umount failed.

You can try:
# mount -t ext3 /dev/sda6 /mnt
# cd /mnt
# sleep 10000 &
# cd ..
# umount /mnt
umount: /mnt: device is busy

And umount is OK for the below example:
# mount -t ext3 /dev/sda6 /mnt
# sleep 10000 &
# umount /mnt

> echo pid > tasks        # pid is of infinite task
> cd ..                   # we are now in root group
> echo pid > /tasks       # move the task to root group
> rmdir group1;           # Succeeds even when I was inside this group
> in another shell
> cd ..
> umount /cpu;    # this fails for me as below
> [root@...ik-laptop /]# umount cpu/
> umount: cpu/: device is busy
> 
> And I see that cat /proc/cgroups shows me still num_cgroups as 2;
> 
> I checked it on two kernels.
> [root@...ik-laptop cpu]# uname -a
> Linux malik-laptop.in.ibm.com 2.6.26 #1 SMP Tue Aug 12 16:39:18 IST
> 2008 i686 i686 i386 GNU/Linux
> 
> [root@...5b sudhir]# uname -a
> Linux e325b.in.ibm.com 2.6.28-rc6 #1 SMP Mon Dec 1 15:53:09 IST 2008
> i686 athlon i386 GNU/Linux
> 
> A look on /proc/cgroups
> root@...5b sudhir]# cat /proc/cgroups
> #subsys_name    hierarchy       num_cgroups     enabled
> #cpuset  0       1       1
> #debug   0       1       1
> #ns      0       1       1
> #cpu     8       2       1
> #cpuacct 0       1       1
> #freezer 0       1       1
> #
> 
> Please let me know if further information is required or I am doing
> something wrong ?
> 
> Thanks
> Sudhir
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/