lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Mon, 22 Dec 2008 09:24:06 +0800 From: Li Zefan <lizf@...fujitsu.com> To: Andrew Morton <akpm@...ux-foundation.org> CC: Paul Menage <menage@...gle.com>, Peter Zijlstra <a.p.zijlstra@...llo.nl>, LKML <linux-kernel@...r.kernel.org> Subject: [PATCH -mm] a fixlet for cgroups-make-cgroup_path-rcu-safe.patch With cgroups-make-cgroup_path-rcu-safe.patch applied, I can trigger kernel panic easily using this test program: for ((; ;)) { mount -t cgroup -o debug xxx /mnt mkdir /mnt/0 rmdir /mnt/0 umount /mnt } It's caused by the deactive_super() in rcu callback. This patch restores the original code that call deactive_super() in cgroup_diput(). Also remove duplicated comment in cgroup.h added by the patch. Signed-off-by: Li Zefan <lizf@...fujitsu.com> --- include/linux/cgroup.h | 6 ------ kernel/cgroup.c | 11 ++++++----- 2 files changed, 6 insertions(+), 11 deletions(-) diff --git a/include/linux/cgroup.h.orig b/include/linux/cgroup.h index 880528d..e267e62 100644 --- a/include/linux/cgroup.h.orig +++ b/include/linux/cgroup.h @@ -334,12 +334,6 @@ int cgroup_add_files(struct cgroup *cgrp, int cgroup_is_removed(const struct cgroup *cgrp); -/* - * cgroup_path() fills in a filesystem-like path for the given cgroup - * into "buf", up to "buflen" characters. Should be called with - * cgroup_mutex held, or else in an RCU section with an RCU-protected - * cgroup reference - */ int cgroup_path(const struct cgroup *cgrp, char *buf, int buflen); int cgroup_task_count(const struct cgroup *cgrp); diff --git a/kernel/cgroup.c.orig b/kernel/cgroup.c index 5cfd005..d49e97d 100644 --- a/kernel/cgroup.c.orig +++ b/kernel/cgroup.c @@ -598,11 +598,6 @@ static void cgroup_call_pre_destroy(struct cgroup *cgrp) static void free_cgroup_rcu(struct rcu_head *obj) { struct cgroup *cgrp = container_of(obj, struct cgroup, rcu_head); - /* - * Drop the active superblock reference that we took when we - * created the cgroup - */ - deactivate_super(cgrp->root->sb); kfree(cgrp); } @@ -632,6 +627,12 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode) cgrp->root->number_of_cgroups--; mutex_unlock(&cgroup_mutex); + /* + * Drop the active superblock reference that we took when we + * created the cgroup + */ + deactivate_super(cgrp->root->sb); + call_rcu(&cgrp->rcu_head, free_cgroup_rcu); } iput(inode); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists