Commit 712317ad authored by Li Zefan's avatar Li Zefan Committed by Tejun Heo
Browse files

cgroup: fix broken file xattrs 



We should store file xattrs in struct cfent instead of struct cftype,
because cftype is a type while cfent is object instance of cftype.

For example each cgroup has a tasks file, and each tasks file is
associated with a uniq cfent, but all those files share the same
struct cftype.

Alexey Kodanev reported a crash, which can be reproduced:

  # mount -t cgroup -o xattr /sys/fs/cgroup
  # mkdir /sys/fs/cgroup/test
  # setfattr -n trusted.value -v test_value /sys/fs/cgroup/tasks
  # rmdir /sys/fs/cgroup/test
  # umount /sys/fs/cgroup
  oops!

In this case, simple_xattrs_free() will free the same struct simple_xattrs
twice.

tj: Dropped unused local variable @cft from cgroup_diput().

Cc: <stable@vger.kernel.org> # 3.8.x
Reported-by: default avatarAlexey Kodanev <alexey.kodanev@oracle.com>
Signed-off-by: default avatarLi Zefan <lizefan@huawei.com>
Signed-off-by: default avatarTejun Heo <tj@kernel.org>
parent e57d5cf2

include/linux/cgroup.h

+0 −3
Original line number Diff line number Diff line
@@ -422,9 +422,6 @@ struct cftype { 
	/* CFTYPE_* flags */

	unsigned int flags;



	/* file xattrs */

	struct simple_xattrs xattrs;



	int (*open)(struct inode *inode, struct file *file);

	ssize_t (*read)(struct cgroup *cgrp, struct cftype *cft,

			struct file *file,

kernel/cgroup.c

+6 −5
Original line number Diff line number Diff line
@@ -117,6 +117,9 @@ struct cfent { 
	struct list_head		node;

	struct dentry			*dentry;

	struct cftype			*type;



	/* file xattrs */

	struct simple_xattrs		xattrs;

};



/*
@@ -882,13 +885,12 @@ static void cgroup_diput(struct dentry *dentry, struct inode *inode) 
	} else {

		struct cfent *cfe = __d_cfe(dentry);

		struct cgroup *cgrp = dentry->d_parent->d_fsdata;

		struct cftype *cft = cfe->type;



		WARN_ONCE(!list_empty(&cfe->node) &&

			  cgrp != &cgrp->root->top_cgroup,

			  "cfe still linked for %s\n", cfe->type->name);

		simple_xattrs_free(&cfe->xattrs);

		kfree(cfe);

		simple_xattrs_free(&cft->xattrs);

	}

	iput(inode);

}
@@ -2501,7 +2503,7 @@ static struct simple_xattrs *__d_xattrs(struct dentry *dentry) 
	if (S_ISDIR(dentry->d_inode->i_mode))

		return &__d_cgrp(dentry)->xattrs;

	else

		return &__d_cft(dentry)->xattrs;

		return &__d_cfe(dentry)->xattrs;

}



static inline int xattr_enabled(struct dentry *dentry)
@@ -2677,8 +2679,6 @@ static int cgroup_add_file(struct cgroup *cgrp, struct cgroup_subsys *subsys, 
	umode_t mode;

	char name[MAX_CGROUP_TYPE_NAMELEN + MAX_CFTYPE_NAME + 2] = { 0 };



	simple_xattrs_init(&cft->xattrs);



	if (subsys && !(cgrp->root->flags & CGRP_ROOT_NOPREFIX)) {

		strcpy(name, subsys->name);

		strcat(name, ".");
@@ -2703,6 +2703,7 @@ static int cgroup_add_file(struct cgroup *cgrp, struct cgroup_subsys *subsys, 
		cfe->type = (void *)cft;

		cfe->dentry = dentry;

		dentry->d_fsdata = cfe;

		simple_xattrs_init(&cfe->xattrs);

		list_add_tail(&cfe->node, &parent->files);

		cfe = NULL;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE