From: Matt Fleming <matt@codeblueprint.co.uk>
To: Greg KH <gregkh@linuxfoundation.org>
Cc: stable@vger.kernel.org, linux-kernel@vger.kernel.org,
Konstantin Khlebnikov <khlebnikov@yandex-team.ru>,
Peter Zijlstra <peterz@infradead.org>,
Linus Torvalds <torvalds@linux-foundation.org>,
Tejun Heo <tj@kernel.org>, Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@kernel.org>
Subject: Re: [PATCH v4.4.y] sched/cgroup: Move sched_online_group() back into css_online() to fix crash
Date: Wed, 26 Jul 2017 13:05:23 +0100 [thread overview]
Message-ID: <20170726120523.GA3414@codeblueprint.co.uk> (raw)
In-Reply-To: <20170725180439.GC24730@kroah.com>
On Tue, 25 Jul, at 11:04:39AM, Greg KH wrote:
> On Thu, Jul 20, 2017 at 02:53:09PM +0100, Matt Fleming wrote:
> > From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
> >
> > commit 96b777452d8881480fd5be50112f791c17db4b6b upstream.
> >
> > Commit:
> >
> > 2f5177f0fd7e ("sched/cgroup: Fix/cleanup cgroup teardown/init")
> >
> > .. moved sched_online_group() from css_online() to css_alloc().
> > It exposes half-baked task group into global lists before initializing
> > generic cgroup stuff.
> >
> > LTP testcase (third in cgroup_regression_test) written for testing
> > similar race in kernels 2.6.26-2.6.28 easily triggers this oops:
> >
> > BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
> > IP: kernfs_path_from_node_locked+0x260/0x320
> > CPU: 1 PID: 30346 Comm: cat Not tainted 4.10.0-rc5-test #4
> > Call Trace:
> > ? kernfs_path_from_node+0x4f/0x60
> > kernfs_path_from_node+0x3e/0x60
> > print_rt_rq+0x44/0x2b0
> > print_rt_stats+0x7a/0xd0
> > print_cpu+0x2fc/0xe80
> > ? __might_sleep+0x4a/0x80
> > sched_debug_show+0x17/0x30
> > seq_read+0xf2/0x3b0
> > proc_reg_read+0x42/0x70
> > __vfs_read+0x28/0x130
> > ? security_file_permission+0x9b/0xc0
> > ? rw_verify_area+0x4e/0xb0
> > vfs_read+0xa5/0x170
> > SyS_read+0x46/0xa0
> > entry_SYSCALL_64_fastpath+0x1e/0xad
> >
> > Here the task group is already linked into the global RCU-protected 'task_groups'
> > list, but the css->cgroup pointer is still NULL.
> >
> > This patch reverts this chunk and moves online back to css_online().
> >
> > Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
> > Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
> > Cc: Linus Torvalds <torvalds@linux-foundation.org>
> > Cc: Peter Zijlstra <peterz@infradead.org>
> > Cc: Tejun Heo <tj@kernel.org>
> > Cc: Thomas Gleixner <tglx@linutronix.de>
> > Fixes: 2f5177f0fd7e ("sched/cgroup: Fix/cleanup cgroup teardown/init")
> > Link: http://lkml.kernel.org/r/148655324740.424917.5302984537258726349.stgit@buzz
> > Signed-off-by: Ingo Molnar <mingo@kernel.org>
> > Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
> > ---
> > kernel/sched/core.c | 14 ++++++++++++--
> > 1 file changed, 12 insertions(+), 2 deletions(-)
>
> What about 4.9-stable, this should go there too, right?
Yes, good catch. Would you like me to send a separate patch?
next prev parent reply other threads:[~2017-07-26 12:05 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-20 13:53 [PATCH v4.4.y] sched/cgroup: Move sched_online_group() back into css_online() to fix crash Matt Fleming
2017-07-25 18:04 ` Greg KH
2017-07-26 12:05 ` Matt Fleming [this message]
2017-07-26 14:35 ` Greg KH
2017-07-26 20:59 ` Matt Fleming
2017-08-03 22:33 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170726120523.GA3414@codeblueprint.co.uk \
--to=matt@codeblueprint.co.uk \
--cc=gregkh@linuxfoundation.org \
--cc=khlebnikov@yandex-team.ru \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
--cc=tj@kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).