Commit 7a31b44d authored by Waiman Long's avatar Waiman Long Committed by Chen Ridong
Browse files

cgroup: Protect css->cgroup write under css_set_lock 

stable inclusion
from stable-v4.19.322
commit 6760357063f593a17613e015aed2051cfd4197c6
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAYN0Z

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6760357063f593a17613e015aed2051cfd4197c6



--------------------------------

[ Upstream commit 57b56d16800e8961278ecff0dc755d46c4575092 ]

The writing of css->cgroup associated with the cgroup root in
rebind_subsystems() is currently protected only by cgroup_mutex.
However, the reading of css->cgroup in both proc_cpuset_show() and
proc_cgroup_show() is protected just by css_set_lock. That makes the
readers susceptible to racing problems like data tearing or caching.
It is also a problem that can be reported by KCSAN.

This can be fixed by using READ_ONCE() and WRITE_ONCE() to access
css->cgroup. Alternatively, the writing of css->cgroup can be moved
under css_set_lock as well which is done by this patch.

Signed-off-by: default avatarWaiman Long <longman@redhat.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarChen Ridong <chenridong@huawei.com>
parent fc5b1a61

kernel/cgroup/cgroup.c

+1 −1
Original line number Diff line number Diff line
@@ -1717,9 +1717,9 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask) 
		RCU_INIT_POINTER(scgrp->subsys[ssid], NULL);

		rcu_assign_pointer(dcgrp->subsys[ssid], css);

		ss->root = dst_root;

		css->cgroup = dcgrp;



		spin_lock_irq(&css_set_lock);

		css->cgroup = dcgrp;

		WARN_ON(!list_empty(&dcgrp->e_csets[ss->id]));

		list_for_each_entry_safe(cset, cset_pos, &scgrp->e_csets[ss->id],

					 e_cset_node[ss->id]) {