linux-kernel - Re: [REGRESSION] cgroup: notify_on_release may not be triggered in some cases

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 8 Oct 2012 14:11:12 +0800
From:	Li Zefan <lizefan@...wei.com>
To:	Daisuke Nishimura <nishimura@....nes.nec.co.jp>
CC:	LKML <linux-kernel@...r.kernel.org>,
	cgroups <cgroups@...r.kernel.org>,
	Ben Blum <bblum@...rew.cmu.edu>, Tejun Heo <tj@...nel.org>
Subject: Re: [REGRESSION] cgroup: notify_on_release may not be triggered in
 some cases

On 2012/10/4 15:37, Daisuke Nishimura wrote:
> notify_on_release must be triggered when the last process in a cgroup is
> move to another. But if the first(and only) process in a cgroup is moved to
> another, notify_on_release is not triggered.
> 
> 	# mkdir /cgroup/cpu/SRC
> 	# mkdir /cgroup/cpu/DST
> 	#
> 	# echo 1 >/cgroup/cpu/SRC/notify_on_release
> 	# echo 1 >/cgroup/cpu/DST/notify_on_release
> 	#
> 	# sleep 300 &
> 	[1] 8629
> 	#
> 	# echo 8629 >/cgroup/cpu/SRC/tasks
> 	# echo 8629 >/cgroup/cpu/DST/tasks
> 	-> notify_on_release for /SRC must be triggered at this point,
> 	   but it isn't.
> 
> This is because put_css_set() is called before setting CGRP_RELEASABLE
> in cgroup_task_migrate(), and is a regression introduce by the
> commit:74a1166d(cgroups: make procs file writable), which was merged
> into v3.0.
> 
> Cc: Ben Blum <bblum@...rew.cmu.edu>
> Cc: Tejun Heo <tj@...nel.org>
> Cc: Li Zefan <lizefan@...wei.com>
> Cc: <stable@...r.kernel.org> # v3.0.x and later
> Signed-off-by: Daisuke Nishimura <nishimura@....nes.nec.co.jp>
> ---
> This patch is based on v3.6.
> 
>  kernel/cgroup.c |    3 +--
>  1 files changed, 1 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/cgroup.c b/kernel/cgroup.c
> index 7981850..7d01182 100644
> --- a/kernel/cgroup.c
> +++ b/kernel/cgroup.c
> @@ -1923,9 +1923,8 @@ static void cgroup_task_migrate(struct cgroup *cgrp, struct cgroup *oldcgrp,
>  	 * trading it for newcg is protected by cgroup_mutex, we're safe to drop
>  	 * it here; it will be freed under RCU.
>  	 */
> -	put_css_set(oldcg);
> -
>  	set_bit(CGRP_RELEASABLE, &oldcgrp->flags);
> +	put_css_set(oldcg);

Good catch. Also we might end up with invalid memory access! 

Acked-by: Li Zefan <lizefan@...wei.com>

>  }
>  
>  /**
> 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/