cgroups: avoid accessing uninitialized data in failure path
PATCH 1/1 cgroups: avoid accessing uninitialized data in failure path
If cgroup_get_rootdir() failed, free_cg_links() will be called in the failure path, but tmp_cg_links hasn't been initialized at that time.
I should be blamed to introduce this bug in 2.6.26 merge window.
--- kernel/cgroup.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-)
kernel/cgroup.c +3 -2
@@ -1024,7 +1024,7 @@ static int cgroup_get_sb(struct file_system_type *fs_type,if (ret == -EBUSY ) {mutex_unlock (&cgroup_mutex);mutex_unlock (&inode->i_mutex); - goto drop_new_super; + goto free_cg_links; }/* EBUSY should be the only error here */
@@ -1073,10 +1073,11 @@ static int cgroup_get_sb(struct file_system_type *fs_type,return simple_set_mnt (mnt, sb); + free_cg_links: +free_cg_links (&tmp_cg_links); drop_new_super:up_write (&sb->s_umount);deactivate_super (sb); -free_cg_links (&tmp_cg_links);return ret; }
Signature · 1 line
1.5.4.rc3
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 6 lines · Li Zefan
If
cgroup_get_rootdir()failed,free_cg_links()will be called in the failure path, buttmp_cg_linkshasn't been initialized at that time.I should be blamed to introduce this bug in 2.6.26 merge window.
Sorry, I mean 2.6.27 merge window.
Quoted 1 line
Signed-off-by Li Zefan <[email protected]>
Serge E. Hallyn
Acked-byQuoted 7 lines · Li Zefan
If
cgroup_get_rootdir()failed,free_cg_links()will be called in the failure path, buttmp_cg_linkshasn't been initialized at that time.I should be blamed to introduce this bug in 2.6.26 merge window.
Signed-off-by Li Zefan <[email protected]>
Certainly looks right.
Quoted 37 lines
--- kernel/cgroup.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-)kernel/cgroup.c +3
-2@@ -1024,7 +1024,7 @@ static int cgroup_get_sb(struct file_system_type *fs_type,if (ret == -EBUSY ) {mutex_unlock (&cgroup_mutex);mutex_unlock (&inode->i_mutex); - goto drop_new_super; + goto free_cg_links; }/* EBUSY should be the only error here */ @@ -1073,10 +1073,11 @@ static int cgroup_get_sb(struct file_system_type *fs_type,return simple_set_mnt (mnt, sb); + free_cg_links: +free_cg_links (&tmp_cg_links); drop_new_super:up_write (&sb->s_umount);deactivate_super (sb); -free_cg_links (&tmp_cg_links);return ret; }Signature · 6 lines
1.5.4.rc3 _______________________________________________ Containers mailing list Containers-cunTk1MwBs9QetFLy7KEm3xJsTq8ys+cHZ5vskTnxNA@public.gmane.org https://lists.linux-foundation.org/mailman/listinfo/containers
Quoted 6 lines · Li Zefan
If
cgroup_get_rootdir()failed,free_cg_links()will be called in the failure path, buttmp_cg_linkshasn't been initialized at that time.I should be blamed to introduce this bug in 2.6.26 merge window.
Sorry, I mean 2.6.27 merge window.
Quoted 1 line
Signed-off-by Li Zefan <[email protected]>
Quoted 7 lines · Li Zefan
If
cgroup_get_rootdir()failed,free_cg_links()will be called in the failure path, buttmp_cg_linkshasn't been initialized at that time.I should be blamed to introduce this bug in 2.6.26 merge window.
Signed-off-by Li Zefan <[email protected]>
Certainly looks right.
Quoted 37 lines
--- kernel/cgroup.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-)kernel/cgroup.c +3
-2@@ -1024,7 +1024,7 @@ static int cgroup_get_sb(struct file_system_type *fs_type,if (ret == -EBUSY ) {mutex_unlock (&cgroup_mutex);mutex_unlock (&inode->i_mutex); - goto drop_new_super; + goto free_cg_links; }/* EBUSY should be the only error here */ @@ -1073,10 +1073,11 @@ static int cgroup_get_sb(struct file_system_type *fs_type,return simple_set_mnt (mnt, sb); + free_cg_links: +free_cg_links (&tmp_cg_links); drop_new_super:up_write (&sb->s_umount);deactivate_super (sb); -free_cg_links (&tmp_cg_links);return ret; }Signature · 6 lines
1.5.4.rc3 _______________________________________________ Containers mailing list [email protected] https://lists.linux-foundation.org/mailman/listinfo/containers