FROMLIST: cgroup: Fix race condition at rebind_subsystems()

Root cause:
The rebind_subsystems() is no lock held when move css object from A
list to B list,then let B's head be treated as css node at
list_for_each_entry_rcu().

Solution:
Add grace period before invalidating the removed rstat_css_node.

Bug: 236944947
Change-Id: I3bb9577525c7e2a1f4dce4a0b9c84a28e74c2f11
Reported-by: Jing-Ting Wu <jing-ting.wu@mediatek.com>
Suggested-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Jing-Ting Wu <jing-ting.wu@mediatek.com>
Tested-by: Jing-Ting Wu <jing-ting.wu@mediatek.com>
Link: https://lore.kernel.org/linux-arm-kernel/20220823054148.29346-1-Jing-Ting.Wu@mediatek.com/
Signed-off-by: Jing-Ting Wu <Jing-Ting.Wu@mediatek.com>
This commit is contained in:
Jing-Ting Wu
2022-08-23 13:49:08 +08:00
committed by Treehugger Robot
parent 6aafd4a7e6
commit 5a3e902fed

View File

@@ -1813,6 +1813,7 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
if (ss->css_rstat_flush) {
list_del_rcu(&css->rstat_css_node);
synchronize_rcu();
list_add_rcu(&css->rstat_css_node,
&dcgrp->rstat_css_list);
}