Tejun Heo
ad44e05f3e
cgroup: Use separate src/dst nodes when preloading css_sets for migration ...
commit 07fd5b6cdf3cc30bfde8fe0f644771688be04447 upstream.
Each cset (css_set) is pinned by its tasks. When we're moving tasks around
across csets for a migration, we need to hold the source and destination
csets to ensure that they don't go away while we're moving tasks about. This
is done by linking cset->mg_preload_node on either the
mgctx->preloaded_src_csets or mgctx->preloaded_dst_csets list. Using the
same cset->mg_preload_node for both the src and dst lists was deemed okay as
a cset can't be both the source and destination at the same time.
Unfortunately, this overloading becomes problematic when multiple tasks are
involved in a migration and some of them are identity noop migrations while
others are actually moving across cgroups. For example, this can happen with
the following sequence on cgroup1:
#1> mkdir -p /sys/fs/cgroup/misc/a/b
#2> echo $$ > /sys/fs/cgroup/misc/a/cgroup.procs
#3> RUN_A_COMMAND_WHICH_CREATES_MULTIPLE_THREADS &
#4> PID=$!
#5> echo $PID > /sys/fs/cgroup/misc/a/b/tasks
#6> echo $PID > /sys/fs/cgroup/misc/a/cgroup.procs
the process including the group leader back into a. In this final migration,
non-leader threads would be doing identity migration while the group leader
is doing an actual one.
After #3 , let's say the whole process was in cset A, and that after #4 , the
leader moves to cset B. Then, during #6 , the following happens:
1. cgroup_migrate_add_src() is called on B for the leader.
2. cgroup_migrate_add_src() is called on A for the other threads.
3. cgroup_migrate_prepare_dst() is called. It scans the src list.
4. It notices that B wants to migrate to A, so it tries to A to the dst
list but realizes that its ->mg_preload_node is already busy.
5. and then it notices A wants to migrate to A as it's an identity
migration, it culls it by list_del_init()'ing its ->mg_preload_node and
putting references accordingly.
6. The rest of migration takes place with B on the src list but nothing on
the dst list.
This means that A isn't held while migration is in progress. If all tasks
leave A before the migration finishes and the incoming task pins it, the
cset will be destroyed leading to use-after-free.
This is caused by overloading cset->mg_preload_node for both src and dst
preload lists. We wanted to exclude the cset from the src list but ended up
inadvertently excluding it from the dst list too.
This patch fixes the issue by separating out cset->mg_preload_node into
->mg_src_preload_node and ->mg_dst_preload_node, so that the src and dst
preloadings don't interfere with each other.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Mukesh Ojha <quic_mojha@quicinc.com>
Reported-by: shisiyuan <shisiyuan19870131@gmail.com>
Link: http://lkml.kernel.org/r/1654187688-27411-1-git-send-email-shisiyuan@xiaomi.com
Link: https://www.spinics.net/lists/cgroups/msg33313.html
Fixes: f817de9851stable@vger.kernel.org # v3.16+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-07-21 20:59:17 +02:00
iio: st_sensors: Add a local lock for protecting odr
2022-06-14 18:11:59 +02:00
regulator: rt5033: Fix n_voltages settings for BUCK and LDO
2021-08-08 09:04:07 +02:00
net/mlx5: Fix size field in bufferx_reg struct
2022-03-16 13:21:46 +01:00
mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N
2022-06-14 18:12:03 +02:00
power: supply: max17042_battery: fix typo in MAx17042_TOFF
2021-09-15 09:47:27 +02:00
mm, hugetlb: allow for "high" userspace addresses
2022-05-09 09:03:28 +02:00
SUNRPC: Don't call connect() more than once on a TCP socket
2022-05-25 09:14:34 +02:00
usb: core: hcd: Add support for deferring roothub registration
2022-06-14 18:11:24 +02:00
arm64: entry: Add vectors that have the bhb mitigation sequences
2022-03-19 13:40:15 +01:00
block: don't merge across cgroup boundaries if blkcg is enabled
2022-04-15 14:18:01 +02:00
block: return ELEVATOR_DISCARD_MERGE if possible
2022-05-25 09:14:38 +02:00
x86/speculation: Add missing prototype for unpriv_ebpf_notify()
2022-06-14 18:11:34 +02:00
bpf: Fix pointer arithmetic mask tightening under state pruning
2021-09-15 09:47:39 +02:00
drivers: base: cacheinfo: Get rid of DEFINE_SMP_CALL_CACHE_FUNCTION()
2021-09-26 14:07:10 +02:00
cgroup: Use separate src/dst nodes when preloading css_sets for migration
2022-07-21 20:59:17 +02:00
compiler.h: Introduce absolute_pointer macro
2021-09-30 10:09:25 +02:00
serial: core: Fix initializing and restoring termios speed
2021-11-17 09:48:25 +01:00
x86/speculation/mmio: Add sysfs reporting for Processor MMIO Stale Data
2022-06-16 13:23:32 +02:00
random: clear fast pool, crng, and batches in cpuhp bring up
2022-06-22 14:11:12 +02:00
dm: remove special-casing of bio-based immutable singleton target on NVMe
2022-06-25 12:44:35 +02:00
PCI/MSI: Protect msi_desc::masked for multi-MSI
2021-08-18 08:57:03 +02:00
linux/dim: Fix divide by 0 in RDMA DIM
2022-07-07 17:36:49 +02:00
Reinstate some of "swiotlb: rework "fix info leak with DMA_FROM_DEVICE""
2022-05-25 09:14:38 +02:00
efi: Add missing prototype for efi_capsule_setup_info
2022-06-14 18:11:33 +02:00
elfcore: correct reference to CONFIG_UML
2021-10-27 09:54:27 +02:00
PM: EM: Increase energy calculation precision
2021-09-15 09:47:33 +02:00
etherdevice: Adjust ether_addr* prototypes to silence -Wstringop-overead
2022-04-27 13:50:45 +02:00
fbcon: Prevent that screen size is smaller than font size
2022-07-12 16:30:47 +02:00
bpf: Prevent increasing bpf_jit_limit above max
2021-11-17 09:48:20 +01:00
devtmpfs regression fix: reconfigure on each mount
2022-01-20 09:19:17 +01:00
fscrypt: add fscrypt_symlink_getattr() for computing st_size
2021-09-12 08:56:38 +02:00
fsnotify: invalidate dcache before IN_DELETE event
2022-02-01 17:24:39 +01:00
module/ftrace: handle patchable-function-entry
2022-02-23 11:59:56 +01:00
HID: quirks: Allow inverting the absolute X/Y values
2022-01-27 09:19:43 +01:00
hrtimer: Ensure timerfd notification for HIGHRES=n
2021-09-15 09:47:26 +02:00
mm/hugetlb: initialize hugetlb_usage in mm_init
2021-09-22 12:26:37 +02:00
random: pull add_hwgenerator_randomness() declaration into random.h
2022-06-22 14:11:12 +02:00
net: handle ARPHRD_PIMREG in dev_is_mac_header_xmit()
2022-03-23 09:12:07 +01:00
net: igmp: increase size of mr_ifc_count
2021-08-18 08:57:01 +02:00
shm: extend forced shm destroy to support objects from several IPC nses
2021-12-01 09:23:35 +01:00
ipv6: make mc_forwarding atomic
2022-04-15 14:18:32 +02:00
genirq: Provide IRQCHIP_AFFINITY_PRE_STARTUP
2021-08-18 08:57:02 +02:00
hex2bin: make the function hex_to_bin constant-time
2022-05-09 09:03:22 +02:00
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
2022-07-02 16:28:50 +02:00
kprobes: Limit max data_size of the kretprobe instances
2021-12-08 09:01:10 +01:00
KVM: remember position in kvm->vcpus array
2021-09-26 14:07:05 +02:00
libata: fix read log timeout value
2021-11-17 09:48:17 +01:00
include/linux/list.h: add a macro to test if entry is pointing to the head
2021-09-22 12:26:20 +02:00
binder: use cred instead of task for selinux checks
2021-11-17 09:48:16 +01:00
mailbox: forward the hrtimer if not queued and under a lock
2022-06-14 18:11:42 +02:00
rtc: mc146818-lib: Fix the AltCentury for AMD platforms
2022-05-25 09:14:32 +02:00
net: mdio: introduce a shutdown method to mdio device drivers
2021-10-09 14:39:49 +02:00
memblock: fix memblock_phys_alloc() section mismatch error
2022-01-05 12:37:44 +01:00
mm: memcontrol: fix occasional OOMs due to proportional memory.low reclaim
2021-08-26 08:36:22 -04:00
mm/memory_hotplug: use "unsigned long" for PFN in zone_for_pfn_range()
2021-09-22 12:26:43 +02:00
random: move randomize_page() into mm where it belongs
2022-06-22 14:11:17 +02:00
arm: remove CONFIG_ARCH_HAS_HOLES_MEMORYMODEL
2022-05-15 19:54:46 +02:00
PCI/MSI: Protect msi_desc::masked for multi-MSI
2021-08-18 08:57:03 +02:00
net: Fix features skip in for_each_netdev_feature()
2022-05-18 09:47:24 +02:00
netdevice: add the case if dev is NULL
2022-04-15 14:17:56 +02:00
NFS: swap IO handling is slightly different for O_DIRECT IO
2022-04-15 14:18:35 +02:00
nodemask: Fix return values to be unsigned
2022-06-14 18:12:02 +02:00
of: clk: Make <linux/of_clk.h> self-contained
2021-12-08 09:01:08 +01:00
once: Fix panic when module unload
2021-09-03 10:08:12 +02:00
mm, oom: make the calculation of oom badness more accurate
2021-09-03 10:08:12 +02:00
PCI/ACPI: Add Ampere Altra SOC MCFG quirk
2021-09-26 14:07:05 +02:00
PCI: Reduce warnings on possible RW1C corruption
2022-04-15 14:18:15 +02:00
PCI: Add ACS quirks for NXP LX2xx0 and LX2xx2 platforms
2021-09-22 12:26:43 +02:00
perf: Protect perf_guest_cbs with RCU
2022-01-20 09:19:18 +01:00
siphash: use one source of truth for siphash permutations
2022-06-22 14:11:16 +02:00
psi: Fix uaf issue when psi trigger is destroyed while being polled
2022-02-05 12:35:36 +01:00
psi: Fix uaf issue when psi trigger is destroyed while being polled
2022-02-05 12:35:36 +01:00
ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP
2022-06-14 18:11:24 +02:00
random: mark bootloader randomness code as __init
2022-06-22 14:11:19 +02:00
random: quiet urandom warning ratelimit suppression message
2022-06-29 08:58:45 +02:00
rpmsg: Fix rpmsg_create_ept return when RPMSG config is not defined
2021-11-17 09:48:44 +01:00
misc: rtsx_usb: use separate command and response buffers
2022-07-12 16:30:49 +02:00
oom_kill.c: futex: delay the OOM reaper to allow time for proper futex cleanup
2022-04-27 13:50:48 +02:00
lockdown: also lock down previous kgdb use
2022-06-06 08:33:48 +02:00
siphash: use one source of truth for siphash permutations
2022-06-22 14:11:16 +02:00
net/af_unix: fix a data-race in unix_dgram_poll
2021-09-22 12:26:41 +02:00
net: stmmac: disable Split Header (SPH) for Intel platforms
2022-05-25 09:14:38 +02:00
PM: s2idle: ACPI: Fix wakeup interrupts handling
2022-02-16 12:52:50 +01:00
tee: export teedev_open() and teedev_close_context()
2022-03-02 11:41:04 +01:00
thermal/core: Fix thermal_cooling_device_register() prototype
2021-09-26 14:07:10 +02:00
Revert "time: Handle negative seconds correctly in timespec64_to_ns()"
2021-09-16 12:56:13 +02:00
timekeeping: Add raw clock fallback for random_get_entropy()
2022-06-22 14:11:15 +02:00
sched/topology: Make sched_init_numa() use a set for the deduplicating sort
2022-03-08 19:07:48 +01:00
virtio: unexport virtio_finalize_features
2022-03-16 13:21:48 +01:00
virtio: acknowledge all features before access
2022-03-16 13:21:48 +01:00
net: skip virtio_net_hdr_set_proto if protocol already set
2021-12-29 12:23:34 +01:00
wait: add wake_up_pollfree()
2021-12-14 14:49:02 +01:00
