Commit cee0c33c authored Jun 05, 2019 by Tejun Heo

cgroup: css_task_iter_skip()'d iterators must be advanced before accessed



b636fd38 ("cgroup: Implement css_task_iter_skip()") introduced
css_task_iter_skip() which is used to fix task iterations skipping
dying threadgroup leaders with live threads.  Skipping is implemented
as a subportion of full advancing but css_task_iter_next() forgot to
fully advance a skipped iterator before determining the next task to
visit causing it to return invalid task pointers.

Fix it by making css_task_iter_next() fully advance the iterator if it
has been skipped since the previous iteration.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: syzbot
Link: http://lkml.kernel.org/r/00000000000097025d058a7fd785@google.com
Fixes: b636fd38 ("cgroup: Implement css_task_iter_skip()")

parent c03cd773

kernel/cgroup/cgroup.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -4550,6 +4550,10 @@ struct task_struct css_task_iter_next(struct css_task_iter it)

		spin_lock_irq(&css_set_lock);

		/* @it may be half-advanced by skips, finish advancing */
		if (it->flags & CSS_TASK_ITER_SKIPPED)
		css_task_iter_advance(it);

		if (it->task_pos) {
		it->cur_task = list_entry(it->task_pos, struct task_struct,
		cg_list);

Admin message