Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S935013AbcCPOog (ORCPT ); Wed, 16 Mar 2016 10:44:36 -0400 Received: from mail-pf0-f171.google.com ([209.85.192.171]:35735 "EHLO mail-pf0-f171.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933471AbcCPOof (ORCPT ); Wed, 16 Mar 2016 10:44:35 -0400 Date: Wed, 16 Mar 2016 07:44:32 -0700 From: Tejun Heo To: Peter Zijlstra Cc: Kazuki Yamaguchi , Niklas Cassel , linux-kernel@vger.kernel.org Subject: Re: [BUG] sched: leaf_cfs_rq_list use after free Message-ID: <20160316144432.GB6980@mtj.duckdns.org> References: <20216ece-a75c-e3cf-4bae-ccbcf5694e9f@rhe.jp> <20160314112057.GT6356@twins.programming.kicks-ass.net> <20160314120903.GP6375@twins.programming.kicks-ass.net> <20160316142414.GA6980@mtj.duckdns.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20160316142414.GA6980@mtj.duckdns.org> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1313 Lines: 36 Hello, again. On Wed, Mar 16, 2016 at 07:24:14AM -0700, Tejun Heo wrote: > I could be mistaken but AFAICS there doesn't seem to be anything > requiring bothering with the more specialized exit methods. Given > that no css iteration is used and everything is lock protected, the Ooh, missed the rcu protected tg list, so the right shutdown sequence would be the following instead where css_released() takes the tg off the internal RCU protected lists after all usages are drained and css_free() frees it. Thanks. diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 0f5abc6..6d58e8c 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -8335,7 +8335,7 @@ static void cpu_cgroup_css_free(struct cgroup_subsys_state *css) sched_destroy_group(tg); } -static void cpu_cgroup_css_offline(struct cgroup_subsys_state *css) +static void cpu_cgroup_css_released(struct cgroup_subsys_state *css) { struct task_group *tg = css_tg(css); @@ -8701,7 +8701,7 @@ struct cgroup_subsys cpu_cgrp_subsys = { .css_alloc = cpu_cgroup_css_alloc, .css_free = cpu_cgroup_css_free, .css_online = cpu_cgroup_css_online, - .css_offline = cpu_cgroup_css_offline, + .css_released = cpu_cgroup_css_released, .fork = cpu_cgroup_fork, .can_attach = cpu_cgroup_can_attach, .attach = cpu_cgroup_attach,