[lkml]   [2008]   [Dec]   [10]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH] CGroups: Fix a race between rmdir and remount
    Fix a race between rmdir and remount

    When a cgroup is removed, it's unlinked from its parent's children
    list, but not actually freed until the last dentry on it is released
    (at which point cgrp->root->number_of_cgroups is decremented).

    Currently rebind_subsystems checks for the top cgroup's child list
    being empty in order to rebind subsystems into or out of a hierarchy -
    this can result in the set of subsystems bound to a hierarchy being
    different than the set of subsystems with state in the
    removed-but-not-freed cgroup.

    The simplest fix for this is to forbid remounts that change the set of
    subsystems on a hierarchy that has removed-but-not-freed cgroups.

    This bug can be reproduced via:

    mkdir /mnt/cg
    mount -t cgroup -o ns,freezer cgroup /mnt/cg
    mkdir /mnt/cg/foo
    sleep 1h < /mnt/cg/foo &
    rmdir /mnt/cg/foo
    mount -t cgroup -o remount,ns,devices,freezer cgroup /mnt/cg
    kill $!

    Signed-off-by: Paul Menage <>

    kernel/cgroup.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    Index: hierarchy_lock-mmotm-2008-12-09/kernel/cgroup.c
    --- hierarchy_lock-mmotm-2008-12-09.orig/kernel/cgroup.c
    +++ hierarchy_lock-mmotm-2008-12-09/kernel/cgroup.c
    @@ -702,7 +702,7 @@ static int rebind_subsystems(struct cgro
    * any child cgroups exist. This is theoretically supportable
    * but involves complex error handling, so it's being left until
    * later */
    - if (!list_empty(&cgrp->children))
    + if (root->number_of_cgroups > 1)
    return -EBUSY;

    /* Process each subsystem */

     \ /
      Last update: 2008-12-11 00:35    [W:0.020 / U:46.936 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site