cgroup: avoid attaching a cgroup root to two different superblocks, take 2

Commit bfb0b80db5f9 ("cgroup: avoid attaching a cgroup root to two
different superblocks") is broken.  Now we try to fix the race by
delaying the initialization of cgroup root refcnt until a superblock
has been allocated.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Reported-by: Andrei Vagin <avagin@virtuozzo.com>
Tested-by: Andrei Vagin <avagin@virtuozzo.com>
Signed-off-by: Zefan Li <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h
index 4567f12b02e95f6a955c74c62b4e15aa68307773..00f4d6bf048fab1d25068842859075a3e3b952dd 100644 (file)
--- a/kernel/cgroup/cgroup-internal.h
+++ b/kernel/cgroup/cgroup-internal.h
@@ -164,7 +164,7 @@ int cgroup_path_ns_locked(struct cgroup *cgrp, char *buf, size_t buflen,
 
 void cgroup_free_root(struct cgroup_root *root);
 void init_cgroup_root(struct cgroup_root *root, struct cgroup_sb_opts *opts);
-int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask);
+int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask, int ref_flags);
 int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask);
 struct dentry *cgroup_do_mount(struct file_system_type *fs_type, int flags,
                               struct cgroup_root *root, unsigned long magic,

diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index c4a68c438fde24fb5b76df9f1fab5f967201a770..a478995e7ed327d3f92cf676c91622c4ce6f50ec 100644 (file)
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -1072,6 +1072,7 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags,
        struct cgroup_subsys *ss;
        struct dentry *dentry;
        int i, ret;
+       bool new_root = false;
 
        cgroup_lock_and_drain_offline(&cgrp_dfl_root.cgrp);
 
@@ -1181,10 +1182,11 @@ struct dentry *cgroup1_mount(struct file_system_type *fs_type, int flags,
                ret = -ENOMEM;
                goto out_unlock;
        }
+       new_root = true;
 
        init_cgroup_root(root, &opts);
 
-       ret = cgroup_setup_root(root, opts.subsys_mask);
+       ret = cgroup_setup_root(root, opts.subsys_mask, PERCPU_REF_INIT_DEAD);
        if (ret)
                cgroup_free_root(root);
 
@@ -1200,6 +1202,18 @@ out_free:
        dentry = cgroup_do_mount(&cgroup_fs_type, flags, root,
                                 CGROUP_SUPER_MAGIC, ns);
 
+       /*
+        * There's a race window after we release cgroup_mutex and before
+        * allocating a superblock. Make sure a concurrent process won't
+        * be able to re-use the root during this window by delaying the
+        * initialization of root refcnt.
+        */
+       if (new_root) {
+               mutex_lock(&cgroup_mutex);
+               percpu_ref_reinit(&root->cgrp.self.refcnt);
+               mutex_unlock(&cgroup_mutex);
+       }
+
        /*
         * If @pinned_sb, we're reusing an existing root and holding an
         * extra ref on its sb.  Mount is complete.  Put the extra ref.

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 10951d5e35d28e7be8e951da249bdc9e23a19e17..38d9386f46e775ba639ea1e8104b70669d487395 100644 (file)
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1645,7 +1645,7 @@ void init_cgroup_root(struct cgroup_root *root, struct cgroup_sb_opts *opts)
                set_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->cgrp.flags);
 }
 
-int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)
+int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask, int ref_flags)
 {
        LIST_HEAD(tmp_links);
        struct cgroup *root_cgrp = &root->cgrp;
@@ -1661,8 +1661,8 @@ int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)
        root_cgrp->id = ret;
        root_cgrp->ancestor_ids[0] = ret;
 
-       ret = percpu_ref_init(&root_cgrp->self.refcnt, css_release, 0,
-                             GFP_KERNEL);
+       ret = percpu_ref_init(&root_cgrp->self.refcnt, css_release,
+                             ref_flags, GFP_KERNEL);
        if (ret)
                goto out;
 
@@ -4517,7 +4517,7 @@ int __init cgroup_init(void)
        hash_add(css_set_table, &init_css_set.hlist,
                 css_set_hash(init_css_set.subsys));
 
-       BUG_ON(cgroup_setup_root(&cgrp_dfl_root, 0));
+       BUG_ON(cgroup_setup_root(&cgrp_dfl_root, 0, 0));
 
        mutex_unlock(&cgroup_mutex);