[PATCH] cgroup: Protect css->cgroup write under css_set_lock

[PATCH] cgroup: Protect css->cgroup write under css_set_lock

[Waiman Long]

The writing of css->cgroup associated with the cgroup root in
rebind_subsystems() is currently protected only by cgroup_mutex.
However, the reading of css->cgroup in both proc_cpuset_show() and
proc_cgroup_show() is protected just by css_set_lock. That makes the
readers susceptible to racing problems like data tearing or caching.
It is also a problem that can be reported by KCSAN.

This can be fixed by using READ_ONCE() and WRITE_ONCE() to access
css->cgroup. Alternatively, the writing of css->cgroup can be moved
under css_set_lock as well which is done by this patch.

Signed-off-by: Waiman Long <longman@redhat.com>
---
 kernel/cgroup/cgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index ff3c14fa62e6..c8e4b62b436a 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1842,9 +1842,9 @@ int rebind_subsystems(struct cgroup_root *dst_root, u16 ss_mask)
 		RCU_INIT_POINTER(scgrp->subsys[ssid], NULL);
 		rcu_assign_pointer(dcgrp->subsys[ssid], css);
 		ss->root = dst_root;
-		css->cgroup = dcgrp;
 
 		spin_lock_irq(&css_set_lock);
+		css->cgroup = dcgrp;
 		WARN_ON(!list_empty(&dcgrp->e_csets[ss->id]));
 		list_for_each_entry_safe(cset, cset_pos, &scgrp->e_csets[ss->id],
 					 e_cset_node[ss->id]) {
-- 
2.39.3

Re: [PATCH] cgroup: Protect css->cgroup write under css_set_lock

[Tejun Heo]

On Wed, Jul 03, 2024 at 02:52:29PM -0400, Waiman Long wrote:
> The writing of css->cgroup associated with the cgroup root in
> rebind_subsystems() is currently protected only by cgroup_mutex.
> However, the reading of css->cgroup in both proc_cpuset_show() and
> proc_cgroup_show() is protected just by css_set_lock. That makes the
> readers susceptible to racing problems like data tearing or caching.
> It is also a problem that can be reported by KCSAN.
> 
> This can be fixed by using READ_ONCE() and WRITE_ONCE() to access
> css->cgroup. Alternatively, the writing of css->cgroup can be moved
> under css_set_lock as well which is done by this patch.
> 
> Signed-off-by: Waiman Long <longman@redhat.com>

Applied to cgroup/for-6.10-fixes.

Thanks.

-- 
tejun