Patch "cgroup: avoid attaching a cgroup root to two different superblocks" has been added to the 4.10-stable tree

This is a note to let you know that I've just added the patch titled

cgroup: avoid attaching a cgroup root to two different superblocks

to the 4.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch
and it can be found in the queue-4.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Zefan Li <[email protected]>
Date: Fri, 7 Apr 2017 16:51:55 +0800
Subject: cgroup: avoid attaching a cgroup root to two different superblocks

From: Zefan Li <[email protected]>

commit bfb0b80db5f9dca5ac0a5fd0edb765ee555e5a8e upstream.

Run this:

    touch file0
    for ((; ;))
    {
        mount -t cpuset xxx file0
    }

And this concurrently:

    touch file1
    for ((; ;))
    {
        mount -t cpuset xxx file1
    }

We'll trigger a warning like this:

 ------------[ cut here ]------------
 WARNING: CPU: 1 PID: 4675 at lib/percpu-refcount.c:317 percpu_ref_kill_and_confirm+0x92/0xb0
 percpu_ref_kill_and_confirm called more than once on css_release!
 CPU: 1 PID: 4675 Comm: mount Not tainted 4.11.0-rc5+ #5
 Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007
 Call Trace:
  dump_stack+0x63/0x84
  __warn+0xd1/0xf0
  warn_slowpath_fmt+0x5f/0x80
  percpu_ref_kill_and_confirm+0x92/0xb0
  cgroup_kill_sb+0x95/0xb0
  deactivate_locked_super+0x43/0x70
  deactivate_super+0x46/0x60
 ...
 ---[ end trace a79f61c2a2633700 ]---

Here's a race:

Thread A Thread B

cgroup1_mount()

    # alloc a new cgroup root
    cgroup_setup_root()
					cgroup1_mount()
					  # no sb yet, returns NULL
					  kernfs_pin_sb()

					  # but succeeds in getting the refcnt,
					  # so re-use cgroup root
					  percpu_ref_tryget_live()
    # alloc sb with cgroup root
    cgroup_do_mount()

cgroup_kill_sb()

					  # alloc another sb with same root
					  cgroup_do_mount()

cgroup_kill_sb()

We end up using the same cgroup root for two different superblocks, so percpu_ref_kill() will be called twice on the same root when the two superblocks are destroyed.

We should fix to make sure the superblock pinning is really successful.

---
 kernel/cgroup.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -2195,7 +2195,7 @@ static struct dentry *cgroup_mount(struc
 		 * path is super cold.  Let's just sleep a bit and retry.
 		 */
 		pinned_sb = kernfs_pin_sb(root->kf_root, NULL);
-		if (IS_ERR(pinned_sb) ||
+		if (IS_ERR_OR_NULL(pinned_sb) ||
 		    !percpu_ref_tryget_live(&root->cgrp.self.refcnt)) {
 			mutex_unlock(&cgroup_mutex);
 			if (!IS_ERR_OR_NULL(pinned_sb))

Patches currently in stable-queue which might be from [email protected] are

queue-4.10/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch

Hi Greg,

Please drop this patch, as it's broken. I've sent out a new fix, which has been tested by Andrei. It will be merged in 4.12 as the bug isn't likely to happen in real life.

Ok, thanks, now dropped from all stable queues.

greg k-h