diff options
author | Tejun Heo <tj@kernel.org> | 2019-06-05 09:54:34 -0700 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-08-09 17:52:34 +0200 |
commit | 0a9abd277819058b6beafa40bfe0a56f19edec38 (patch) | |
tree | 7f44d0dd5e7506233b8df58b6031cd8974a26554 /kernel | |
parent | 4340d175b89896d069c1e875f5b98c80a408f680 (diff) | |
download | linux-stable-0a9abd277819058b6beafa40bfe0a56f19edec38.tar.gz linux-stable-0a9abd277819058b6beafa40bfe0a56f19edec38.tar.bz2 linux-stable-0a9abd277819058b6beafa40bfe0a56f19edec38.zip |
cgroup: css_task_iter_skip()'d iterators must be advanced before accessed
commit cee0c33c546a93957a52ae9ab6bebadbee765ec5 upstream.
b636fd38dc40 ("cgroup: Implement css_task_iter_skip()") introduced
css_task_iter_skip() which is used to fix task iterations skipping
dying threadgroup leaders with live threads. Skipping is implemented
as a subportion of full advancing but css_task_iter_next() forgot to
fully advance a skipped iterator before determining the next task to
visit causing it to return invalid task pointers.
Fix it by making css_task_iter_next() fully advance the iterator if it
has been skipped since the previous iteration.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: syzbot
Link: http://lkml.kernel.org/r/00000000000097025d058a7fd785@google.com
Fixes: b636fd38dc40 ("cgroup: Implement css_task_iter_skip()")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel')
-rw-r--r-- | kernel/cgroup/cgroup.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 89dd464f6862..ddde75bae7af 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -4303,6 +4303,10 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it) spin_lock_irq(&css_set_lock); + /* @it may be half-advanced by skips, finish advancing */ + if (it->flags & CSS_TASK_ITER_SKIPPED) + css_task_iter_advance(it); + if (it->task_pos) { it->cur_task = list_entry(it->task_pos, struct task_struct, cg_list); |