Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1359623
| From | Niklas Cassel <niklas.cassel@axis.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [BUG] sched: leaf_cfs_rq_list use after free |
| Date | 2016-03-17 09:30 +0100 |
| Message-ID | <rdBtD-4QV-5@gated-at.bofh.it> (permalink) |
| References | <rbOv0-40C-3@gated-at.bofh.it> <rcyRc-35C-11@gated-at.bofh.it> <rcztU-3yx-27@gated-at.bofh.it> <rdkCu-1FX-3@gated-at.bofh.it> <rdlyy-2jP-15@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On 03/16/2016 04:22 PM, Peter Zijlstra wrote:
> Subject: sched: Fix/cleanup cgroup teardown/init
>
> The cpu controller hasn't kept up with the various changes in the whole
> cgroup initialization / destruction sequence, and commit 2e91fa7f6d45
> ("cgroup: keep zombies associated with their original cgroups") caused
> it to explode.
>
> The reason for this is that zombies do not inhibit css_offline() from
> being called, but do stall css_released(). Now we tear down the cfs_rq
> structures on css_offline() but zombies can run after that, leading to
> use-after-free issues.
>
> The solution is to move the tear-down to css_released(), which
> guarantees nobody (including no zombies) is still using our cgroup.
>
> Furthermore, a few simple cleanups are possible too. There doesn't
> appear to be any point to us using css_online() (anymore?) so fold that
> in css_alloc().
>
> And since cgroup code guarantees an RCU grace period between
> css_released() and css_free() we can forgo using call_rcu() and free the
> stuff immediately.
>
> Cc: stable@vger.kernel.org
> Fixes: 2e91fa7f6d45 ("cgroup: keep zombies associated with their original cgroups")
> Suggested-by: Tejun Heo <tj@kernel.org>
> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Survived 500 reboots. Without the patch, I've never gone past 84 reboots.
Tested-by: Niklas Cassel <niklas.cassel@axis.com>
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: [BUG] sched: leaf_cfs_rq_list use after free Kazuki Yamaguchi <k@rhe.jp> - 2016-03-12 11:00 +0100
Re: [BUG] sched: leaf_cfs_rq_list use after free Peter Zijlstra <peterz@infradead.org> - 2016-03-12 15:00 +0100
Re: [BUG] sched: leaf_cfs_rq_list use after free Peter Zijlstra <peterz@infradead.org> - 2016-03-14 12:30 +0100
Re: [BUG] sched: leaf_cfs_rq_list use after free Peter Zijlstra <peterz@infradead.org> - 2016-03-14 13:10 +0100
Re: [BUG] sched: leaf_cfs_rq_list use after free Tejun Heo <tj@kernel.org> - 2016-03-16 15:30 +0100
Re: [BUG] sched: leaf_cfs_rq_list use after free Tejun Heo <tj@kernel.org> - 2016-03-16 15:50 +0100
Re: [BUG] sched: leaf_cfs_rq_list use after free Peter Zijlstra <peterz@infradead.org> - 2016-03-16 16:30 +0100
Re: [BUG] sched: leaf_cfs_rq_list use after free Tejun Heo <tj@kernel.org> - 2016-03-16 18:00 +0100
Re: [BUG] sched: leaf_cfs_rq_list use after free Peter Zijlstra <peterz@infradead.org> - 2016-03-16 18:10 +0100
Re: [BUG] sched: leaf_cfs_rq_list use after free Tejun Heo <tj@kernel.org> - 2016-03-16 18:50 +0100
Re: [BUG] sched: leaf_cfs_rq_list use after free Niklas Cassel <niklas.cassel@axis.com> - 2016-03-17 09:30 +0100
[tip:sched/urgent] sched/cgroup: Fix/cleanup cgroup teardown/init tip-bot for Peter Zijlstra <tipbot@zytor.com> - 2016-03-21 12:20 +0100
csiph-web