Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932365AbcCQI3P (ORCPT ); Thu, 17 Mar 2016 04:29:15 -0400 Received: from bastet.se.axis.com ([195.60.68.11]:49925 "EHLO bastet.se.axis.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751310AbcCQI3K (ORCPT ); Thu, 17 Mar 2016 04:29:10 -0400 Subject: Re: [BUG] sched: leaf_cfs_rq_list use after free To: Peter Zijlstra , Tejun Heo References: <20216ece-a75c-e3cf-4bae-ccbcf5694e9f@rhe.jp> <20160314112057.GT6356@twins.programming.kicks-ass.net> <20160314120903.GP6375@twins.programming.kicks-ass.net> <20160316142414.GA6980@mtj.duckdns.org> <20160316152245.GY6344@twins.programming.kicks-ass.net> CC: Kazuki Yamaguchi , From: Niklas Cassel Message-ID: <56EA6AD2.9050109@axis.com> Date: Thu, 17 Mar 2016 09:29:06 +0100 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Icedove/38.6.0 MIME-Version: 1.0 In-Reply-To: <20160316152245.GY6344@twins.programming.kicks-ass.net> Content-Type: text/plain; charset="windows-1252" Content-Transfer-Encoding: 7bit X-Originating-IP: [10.0.5.55] X-ClientProxiedBy: XBOX01.axis.com (10.0.5.15) To XBOX02.axis.com (10.0.5.16) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1395 Lines: 32 On 03/16/2016 04:22 PM, Peter Zijlstra wrote: > Subject: sched: Fix/cleanup cgroup teardown/init > > The cpu controller hasn't kept up with the various changes in the whole > cgroup initialization / destruction sequence, and commit 2e91fa7f6d45 > ("cgroup: keep zombies associated with their original cgroups") caused > it to explode. > > The reason for this is that zombies do not inhibit css_offline() from > being called, but do stall css_released(). Now we tear down the cfs_rq > structures on css_offline() but zombies can run after that, leading to > use-after-free issues. > > The solution is to move the tear-down to css_released(), which > guarantees nobody (including no zombies) is still using our cgroup. > > Furthermore, a few simple cleanups are possible too. There doesn't > appear to be any point to us using css_online() (anymore?) so fold that > in css_alloc(). > > And since cgroup code guarantees an RCU grace period between > css_released() and css_free() we can forgo using call_rcu() and free the > stuff immediately. > > Cc: stable@vger.kernel.org > Fixes: 2e91fa7f6d45 ("cgroup: keep zombies associated with their original cgroups") > Suggested-by: Tejun Heo > Signed-off-by: Peter Zijlstra (Intel) Survived 500 reboots. Without the patch, I've never gone past 84 reboots. Tested-by: Niklas Cassel