linux-kernel - Re: [PATCH] devcgroup: avoid using cgroup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sun, 15 Mar 2009 12:41:40 +0800
From:	Li Zefan <lizf@...fujitsu.com>
To:	"Serge E. Hallyn" <serue@...ibm.com>
CC:	Linux Containers <containers@...ts.linux-foundation.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Paul Menage <menage@...gle.com>,
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] devcgroup: avoid using cgroup_lock

Serge E. Hallyn wrote:
> Quoting Serge E. Hallyn (serue@...ibm.com):
>> Quoting Li Zefan (lizf@...fujitsu.com):
>>>>> @@ -426,11 +431,11 @@ static int devcgroup_access_write(struct cgroup *cgrp, struct cftype *cft,
>>>>>  				  const char *buffer)
>>>>>  {
>>>>>  	int retval;
>>>>> -	if (!cgroup_lock_live_group(cgrp))
>>>> Does it matter that we no longer check for cgroup_is_removed()?
>>>>
>>> No, this means in a rare case that the write handler is called when the cgroup
>>> is dead, we still do the update work instead of returning ENODEV.
>>>
>>> This is ok, since at that time, accessing cgroup and devcgroup is still valid,
>>> but will have no effect since there is no task in this cgroup and the cgroup
>>> will be destroyed soon.
>> Ok, just wanted to make sure the devcgroup couldn't be partially torn
>> down and risking NULL or freed-memory derefs...
> 
> Ok, so the cgroup's files will be deleted first, then on the directory
> removal the cgroup's data (each whitelist entry) is deleted.  So we can
> let that ordering (by cgroup_clear_directory) ensure that nothing inside
> a file write can happen while the destroy handler is called, right?
> 

When we are in the read/write handler, we have a pin in the dir's dentry
(dentry->d_count > 0), thus cgroup_diput() which destroys the cgroup won't
be called during the read/write.

> (That's why I was worried about not using the cgroup_lock: we need some
> way of synchronizing those.  But I guess we're fine)
> 

Many read/write handlers in other cgroup subsystems don't take cgroup_lock.
:)

>> BTW is that against linux-next?  (didn't seem to apply cleanly against
>> my 2.6.29-rc9)  I guess I'd like to do a little test before acking,
>> though it looks ok based on your answer.
> 
> Acked-by: Serge Hallyn <serue@...ibm.com>
> 
> -serge
> 
> 


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/