| Message ID | 20220823054148.29346-1-Jing-Ting.Wu@mediatek.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [1/1] cgroup: Fix race condition at rebind_subsystems() | expand |
On 8/23/2022 11:11 AM, Jing-Ting Wu wrote: > Root cause: > The rebind_subsystems() is no lock held when move css object from A > list to B list,then let B's head be treated as css node at > list_for_each_entry_rcu(). > > Solution: > Add grace period before invalidating the removed rstat_css_node. > > Reported-by: Jing-Ting Wu <jing-ting.wu@mediatek.com> > Suggested-by: Michal Koutný <mkoutny@suse.com> > Signed-off-by: Jing-Ting Wu <jing-ting.wu@mediatek.com> > Tested-by: Jing-Ting Wu <jing-ting.wu@mediatek.com> > Link: https://lore.kernel.org/linux-arm-kernel/d8f0bc5e2fb6ed259f9334c83279b4c011283c41.camel@mediatek.com/T/ > --- > kernel/cgroup/cgroup.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c > index ffaccd6373f1..0d0c959966ed 100644 > --- a/kernel/cgroup/cgroup.c > +++ b/kernel/cgroup/cgroup.c > @@ -1820,6 +1820,7 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) > > if (ss->css_rstat_flush) { > list_del_rcu(&css->rstat_css_node); > + synchronize_rcu(); > list_add_rcu(&css->rstat_css_node, > &dcgrp->rstat_css_list); > } Good catch. Acked-by: Mukesh Ojha <quic_mojha@quicinc.com> -Mukesh
On Tue, Aug 23, 2022 at 01:41:46PM +0800, Jing-Ting Wu wrote: > Root cause: > The rebind_subsystems() is no lock held when move css object from A > list to B list,then let B's head be treated as css node at > list_for_each_entry_rcu(). > > Solution: > Add grace period before invalidating the removed rstat_css_node. > > Reported-by: Jing-Ting Wu <jing-ting.wu@mediatek.com> > Suggested-by: Michal Koutný <mkoutny@suse.com> > Signed-off-by: Jing-Ting Wu <jing-ting.wu@mediatek.com> > Tested-by: Jing-Ting Wu <jing-ting.wu@mediatek.com> > Link: https://lore.kernel.org/linux-arm-kernel/d8f0bc5e2fb6ed259f9334c83279b4c011283c41.camel@mediatek.com/T/ Applied to cgroup/for-6.0-fixes w/ stable tag added. Thanks.
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index ffaccd6373f1..0d0c959966ed 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -1820,6 +1820,7 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) if (ss->css_rstat_flush) { list_del_rcu(&css->rstat_css_node); + synchronize_rcu(); list_add_rcu(&css->rstat_css_node, &dcgrp->rstat_css_list); }