From: Li Zefan <lizefan@huawei.com>
Date: Thu, 24 Jan 2013 06:43:28 +0000 (+0800)
Subject: cgroup: fix exit() vs rmdir() race
X-Git-Tag: v3.9-rc1~157^2~3
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=71b5707e119653039e6e95213f00479668c79b75;p=pandora-kernel.git

cgroup: fix exit() vs rmdir() race

In cgroup_exit() put_css_set_taskexit() is called without any lock,
which might lead to accessing a freed cgroup:

thread1                           thread2
---------------------------------------------
exit()
  cgroup_exit()
    put_css_set_taskexit()
      atomic_dec(cgrp->count);
                                   rmdir();
      /* not safe !! */
      check_for_release(cgrp);

rcu_read_lock() can be used to make sure the cgroup is alive.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
---

Reading git-diff-tree failed