Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932133AbbHWNLV (ORCPT ); Sun, 23 Aug 2015 09:11:21 -0400 Received: from mail-wi0-f179.google.com ([209.85.212.179]:37563 "EHLO mail-wi0-f179.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753570AbbHWNK7 (ORCPT ); Sun, 23 Aug 2015 09:10:59 -0400 From: Aleksa Sarai To: tj@kernel.org Cc: linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, Aleksa Sarai Subject: [PATCH 2/2] cgroup: pids: fix invalid get/put usage Date: Sun, 23 Aug 2015 23:10:32 +1000 Message-Id: <1440335432-4202-3-git-send-email-cyphar@cyphar.com> X-Mailer: git-send-email 2.5.0 In-Reply-To: <1440335432-4202-1-git-send-email-cyphar@cyphar.com> References: <1440335432-4202-1-git-send-email-cyphar@cyphar.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1876 Lines: 59 Fix incorrect usage of css_get and css_put to put a different css in pids_{cancel_,}attach() than the one grabbed in pids_can_attach(). This could lead to quite serious memory leakage (and unsafe operations on the putted css). Signed-off-by: Aleksa Sarai --- kernel/cgroup_pids.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/kernel/cgroup_pids.c b/kernel/cgroup_pids.c index d75488824ae2..f116ca77a658 100644 --- a/kernel/cgroup_pids.c +++ b/kernel/cgroup_pids.c @@ -177,7 +177,7 @@ static int pids_can_attach(struct cgroup_subsys_state *css, * we either fail and hit ->cancel_attach() or succeed and hit * ->attach(). */ - old_css = task_get_css(task, pids_cgrp_id); + old_css = task_css(task, pids_cgrp_id); old_pids = css_pids(old_css); pids_charge(pids, 1); @@ -202,19 +202,9 @@ static void pids_cancel_attach(struct cgroup_subsys_state *css, pids_charge(old_pids, 1); pids_uncharge(pids, 1); - css_put(old_css); } } -static void pids_attach(struct cgroup_subsys_state *css, - struct cgroup_taskset *tset) -{ - struct task_struct *task; - - cgroup_taskset_for_each(task, tset) - css_put(task_css(task, pids_cgrp_id)); -} - static int pids_can_fork(struct task_struct *task, void **priv_p) { struct cgroup_subsys_state *css; @@ -354,7 +344,6 @@ static struct cftype pids_files[] = { struct cgroup_subsys pids_cgrp_subsys = { .css_alloc = pids_css_alloc, .css_free = pids_css_free, - .attach = pids_attach, .can_attach = pids_can_attach, .cancel_attach = pids_cancel_attach, .can_fork = pids_can_fork, -- 2.5.0 -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/