From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965334AbbJ2DCZ (ORCPT ); Wed, 28 Oct 2015 23:02:25 -0400 Received: from mail-pa0-f45.google.com ([209.85.220.45]:35195 "EHLO mail-pa0-f45.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S965235AbbJ2DCX (ORCPT ); Wed, 28 Oct 2015 23:02:23 -0400 Date: Thu, 29 Oct 2015 12:02:17 +0900 From: Tejun Heo To: Li Zefan , Johannes Weiner Cc: cgroups@vger.kernel.org, linux-kernel@vger.kernel.org, Calvin Owens , kernel-team@fb.com Subject: Re: [PATCH cgroup/for-4.4] cgroup: fix race condition around termination check in css_task_iter_next() Message-ID: <20151029030217.GC27115@mtj.duckdns.org> References: <20151027084504.GB8783@mtj.duckdns.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20151027084504.GB8783@mtj.duckdns.org> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Oct 27, 2015 at 05:45:04PM +0900, Tejun Heo wrote: > css_task_iter_next() checked @it->cur_task before grabbing > css_set_lock and assumed that the result won't change afterwards; > however, tasks could leave the cgroup being iterated terminating the > iterator before css_task_lock is acquired. If this happens, > css_task_iter_next() tries to calculate the current task from NULL > cg_list pointer leading to the following oops. Applied to cgroup/for-4.4. Thanks. -- tejun