mirror of https://github.com/torvalds/linux.git
eea51c6e3f
css_rstat_exit() may be called asynchronously in scenarios where preceding
calls to css_rstat_init() have not completed. One such example is this
sequence below:
css_create(...)
{
...
init_and_link_css(css, ...);
err = percpu_ref_init(...);
if (err)
goto err_free_css;
err = cgroup_idr_alloc(...);
if (err)
goto err_free_css;
err = css_rstat_init(css, ...);
if (err)
goto err_free_css;
...
err_free_css:
INIT_RCU_WORK(&css->destroy_rwork, css_free_rwork_fn);
queue_rcu_work(cgroup_destroy_wq, &css->destroy_rwork);
return ERR_PTR(err);
}
If any of the three goto jumps are taken, async cleanup will begin and
css_rstat_exit() will be invoked on an uninitialized css->rstat_cpu.
Avoid accessing the unitialized field by returning early in
css_rstat_exit() if this is the case.
Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
Suggested-by: Michal Koutný <mkoutny@suse.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| Makefile | ||
| cgroup-internal.h | ||
| cgroup-v1.c | ||
| cgroup.c | ||
| cpuset-internal.h | ||
| cpuset-v1.c | ||
| cpuset.c | ||
| debug.c | ||
| dmem.c | ||
| freezer.c | ||
| legacy_freezer.c | ||
| misc.c | ||
| namespace.c | ||
| pids.c | ||
| rdma.c | ||
| rstat.c | ||