Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755193AbbKWWYB (ORCPT ); Mon, 23 Nov 2015 17:24:01 -0500 Received: from arcturus.aphlor.org ([188.246.204.175]:49839 "EHLO arcturus.aphlor.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752917AbbKWWX7 (ORCPT ); Mon, 23 Nov 2015 17:23:59 -0500 Date: Mon, 23 Nov 2015 17:23:44 -0500 From: Dave Jones To: Tejun Heo Cc: Li Zefan , Johannes Weiner , cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, Daniel Wagner , kernel-team@fb.com Subject: Re: [PATCH cgroup/for-4.4-fixes] cgroup: make css_set pin its css's to avoid use-afer-free Message-ID: <20151123222344.GA6117@codemonkey.org.uk> Mail-Followup-To: Dave Jones , Tejun Heo , Li Zefan , Johannes Weiner , cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, Daniel Wagner , kernel-team@fb.com References: <20151123195541.GA19072@mtj.duckdns.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151123195541.GA19072@mtj.duckdns.org> User-Agent: Mutt/1.5.24 (2015-08-30) X-Spam-Score: -2.9 (--) X-Spam-Report: Spam report generated by SpamAssassin on "arcturus.aphlor.org" Content analysis details: (-2.9 points, 5.0 required) pts rule name description ---- ---------------------- -------------------------------------------------- -1.0 ALL_TRUSTED Passed through trusted hosts only via SMTP -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1% [score: 0.0000] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1072 Lines: 23 On Mon, Nov 23, 2015 at 02:55:41PM -0500, Tejun Heo wrote: > A css_set represents the relationship between a set of tasks and > css's. css_set never pinned the associated css's. This was okay > because tasks used to always disassociate immediately (in RCU sense) - > either a task is moved to a different css_set or exits and never > accesses css_set again. > > Unfortunately, afcf6c8b7544 ("cgroup: add cgroup_subsys->free() method > and use it to fix pids controller") and patches leading up to it made > a zombie hold onto its css_set and deref the associated css's on its > release. Nothing pins the css's after exit and it might have already > been freed leading to use-after-free. > > Fix it by making css_set pin the associate css's until its release. This gets me booting again, thanks Tejun! Dave -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/