cgroup fixes for v5.19-rc6

This pull request contains the fix for an old and subtle bug in the
 migration path. css_sets are used to track tasks and migrations are tasks
 moving from a group of css_sets to another group of css_sets. The migration
 path pins all source and destination css_sets in the prep stage.
 Unfortunately, it was overloading the same list_head entry to track sources
 and destinations, which got confused for migrations which are partially
 identity leading to use-after-frees. Fixed by using dedicated list_heads for
 tracking sources and destinations.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYIACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCYs48bg4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGb+HAQDNfUNLYajLjwJNklQdu/S4fxsg0qiY6J8SVkpo
 NYP2zQEAjZmBdNnW8MqutETBCwKq8v80gCphIT/Z72NNPStqPgQ=
 =r72j
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-5.19-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fix from Tejun Heo:
 "Fix an old and subtle bug in the migration path.

  css_sets are used to track tasks and migrations are tasks moving from
  a group of css_sets to another group of css_sets. The migration path
  pins all source and destination css_sets in the prep stage.

  Unfortunately, it was overloading the same list_head entry to track
  sources and destinations, which got confused for migrations which are
  partially identity leading to use-after-frees.

  Fixed by using dedicated list_heads for tracking sources and
  destinations"

* tag 'cgroup-for-5.19-rc6-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup: Use separate src/dst nodes when preloading css_sets for migration
This commit is contained in:
Linus Torvalds 2022-07-13 11:47:01 -07:00
commit d0b97f3891
2 changed files with 25 additions and 15 deletions