Li Zefan 71b5707e11 cgroup: fix exit() vs rmdir() race
In cgroup_exit() put_css_set_taskexit() is called without any lock,
which might lead to accessing a freed cgroup:

thread1                           thread2
---------------------------------------------
exit()
  cgroup_exit()
    put_css_set_taskexit()
      atomic_dec(cgrp->count);
                                   rmdir();
      /* not safe !! */
      check_for_release(cgrp);

rcu_read_lock() can be used to make sure the cgroup is alive.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
2013-02-18 09:08:10 -08:00
..
2012-10-13 11:16:58 +09:00
2011-07-26 16:49:45 -07:00
2012-12-18 15:02:11 -08:00
2013-02-18 09:08:10 -08:00
2012-05-31 17:49:27 -07:00
2011-07-14 12:59:14 +03:00
2012-03-28 18:30:03 +01:00
2012-12-20 17:40:19 -08:00
2012-10-06 03:05:19 +09:00
2012-05-29 23:28:41 -04:00
2012-06-13 21:16:42 +02:00
2012-03-28 18:30:03 +01:00
2012-10-29 21:31:32 +01:00
2012-12-16 15:18:08 -08:00