cgroups: fix cgroup_iter_next() bug.

PATCH In review Lai Jiangshan 3 participants 3 messages Nov 21, 2008 1 message not in the archive

Share & tools

Lai Jiangshan

author

2008-11-21 08:54 UTC #0 lore raw

PATCH 1/1 cgroups: fix cgroup_iter_next() bug.

we access to res->cgroups without the task_lock(), so res->cgroups may be changed. it's unreliable, and "if (l == &res->cgroups->tasks)" may be false forever.

we don't need add any lock for fixing this bug. we just access to struct css_set by struct cg_cgroup_link, not by struct task_struct.

since we hold css_set_lock, struct cg_cgroup_link is reliable.

Signed-off-by Lai Jiangshan <[email protected]>

---

kernel/cgroup.c +3 -1

index 358e775..ddc10ac 100644
@@ -1810,6 +1819,7 @@ struct task_struct *cgroup_iter_next(struct cgroup *cgrp,
 {
 	struct task_struct *res;
 	struct list_head *l = it->task;
+	struct cg_cgroup_link *link;
 
 	/* If the iterator cg is NULL, we have no tasks */
 	if (!it->cg_link)

@@ -1817,7 +1827,8 @@ struct task_struct *cgroup_iter_next(struct cgroup *cgrp,
 	res = list_entry(l, struct task_struct, cg_list);
 	/* Advance iterator to find next entry */
 	l = l->next;
-	if (l == &res->cgroups->tasks) {
+	link = list_entry(it->cg_link, struct cg_cgroup_link, cgrp_link_list);
+	if (l == &link->cg->tasks) {
 		/* We reached the end of this task list - move on to
 		 * the next cg_cgroup_link */
 		cgroup_advance_iter(cgrp, it);

A message that is not in the archive (sent off-list or not yet received): [email protected]

Paul Menage

Reviewed-by

2008-11-21 17:38 UTC #2 lore raw

Quoted 11 lines · Lai Jiangshan

we access to res->cgroups without the task_lock(), so res->cgroups may be changed. it's unreliable, and "if (l == &res->cgroups->tasks)" may be false forever.
we don't need add any lock for fixing this bug. we just access to struct css_set by struct cg_cgroup_link, not by struct task_struct.
since we hold css_set_lock, struct cg_cgroup_link is reliable.
Signed-off-by Lai Jiangshan <[email protected]>

Sounds plausible - you'd need to have thread A have completed the call to find_css_set() and then have the iteration begin in thread B, so it's a pretty tight race. But accessing through the cs_cgroup_link is probably conceptually better anyway, regardless of races.

Thanks.

Reviewed-by Paul Menage <[email protected]>

Quoted 26 lines

---

kernel/cgroup.c +3 -1

index 358e775..ddc10ac 100644
@@ -1810,6 +1819,7 @@ struct task_struct *cgroup_iter_next(struct cgroup *cgrp,
 {
       struct task_struct *res;
       struct list_head *l = it->task;
+       struct cg_cgroup_link *link;
 
       /* If the iterator cg is NULL, we have no tasks */
       if (!it->cg_link)

@@ -1817,7 +1827,8 @@ struct task_struct *cgroup_iter_next(struct cgroup *cgrp,
       res = list_entry(l, struct task_struct, cg_list);
       /* Advance iterator to find next entry */
       l = l->next;
-       if (l == &res->cgroups->tasks) {
+       link = list_entry(it->cg_link, struct cg_cgroup_link, cgrp_link_list);
+       if (l == &link->cg->tasks) {
               /* We reached the end of this task list - move on to
                * the next cg_cgroup_link */
               cgroup_advance_iter(cgrp, it);

Paul Menage

Reviewed-by on v1 1/1

2008-11-21 17:38 UTC #3 lore raw

In reply to Lai Jiangshan

Quoted 11 lines · Lai Jiangshan

we access to res->cgroups without the task_lock(), so res->cgroups may be changed. it's unreliable, and "if (l == &res->cgroups->tasks)" may be false forever.
we don't need add any lock for fixing this bug. we just access to struct css_set by struct cg_cgroup_link, not by struct task_struct.
since we hold css_set_lock, struct cg_cgroup_link is reliable.
Signed-off-by Lai Jiangshan <[email protected]>

Thanks.

Reviewed-by Paul Menage <[email protected]>

Quoted 26 lines

---

kernel/cgroup.c +3 -1

index 358e775..ddc10ac 100644
@@ -1810,6 +1819,7 @@ struct task_struct *cgroup_iter_next(struct cgroup *cgrp,
 {
       struct task_struct *res;
       struct list_head *l = it->task;
+       struct cg_cgroup_link *link;
 
       /* If the iterator cg is NULL, we have no tasks */
       if (!it->cg_link)

@@ -1817,7 +1827,8 @@ struct task_struct *cgroup_iter_next(struct cgroup *cgrp,
       res = list_entry(l, struct task_struct, cg_list);
       /* Advance iterator to find next entry */
       l = l->next;
-       if (l == &res->cgroups->tasks) {
+       link = list_entry(it->cg_link, struct cg_cgroup_link, cgrp_link_list);
+       if (l == &link->cg->tasks) {
               /* We reached the end of this task list - move on to
                * the next cg_cgroup_link */
               cgroup_advance_iter(cgrp, it);