Merge tag 'driver-core-6.8-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git...

[sfrench/cifs-2.6.git] / kernel / cgroup / cgroup.c

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 4bc8183b669f0784bcf1dba44b870b6a7f4a25e8..a66c088c851cfb87036ccc93317f7357769cb268 100644 (file)
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1315,7 +1315,7 @@ static void cgroup_exit_root_id(struct cgroup_root *root)
 
 void cgroup_free_root(struct cgroup_root *root)
 {
-       kfree(root);
+       kfree_rcu(root, rcu);
 }
 
 static void cgroup_destroy_root(struct cgroup_root *root)
@@ -1347,10 +1347,9 @@ static void cgroup_destroy_root(struct cgroup_root *root)
 
        spin_unlock_irq(&css_set_lock);
 
-       if (!list_empty(&root->root_list)) {
-               list_del(&root->root_list);
-               cgroup_root_count--;
-       }
+       WARN_ON_ONCE(list_empty(&root->root_list));
+       list_del_rcu(&root->root_list);
+       cgroup_root_count--;
 
        if (!have_favordynmods)
                cgroup_favor_dynmods(root, false);
@@ -1390,7 +1389,15 @@ static inline struct cgroup *__cset_cgroup_from_root(struct css_set *cset,
                }
        }
 
-       BUG_ON(!res_cgroup);
+       /*
+        * If cgroup_mutex is not held, the cgrp_cset_link will be freed
+        * before we remove the cgroup root from the root_list. Consequently,
+        * when accessing a cgroup root, the cset_link may have already been
+        * freed, resulting in a NULL res_cgroup. However, by holding the
+        * cgroup_mutex, we ensure that res_cgroup can't be NULL.
+        * If we don't hold cgroup_mutex in the caller, we must do the NULL
+        * check.
+        */
        return res_cgroup;
 }
 
@@ -1413,6 +1420,11 @@ current_cgns_cgroup_from_root(struct cgroup_root *root)
 
        rcu_read_unlock();
 
+       /*
+        * The namespace_sem is held by current, so the root cgroup can't
+        * be umounted. Therefore, we can ensure that the res is non-NULL.
+        */
+       WARN_ON_ONCE(!res);
        return res;
 }
 
@@ -1449,7 +1461,6 @@ static struct cgroup *current_cgns_cgroup_dfl(void)
 static struct cgroup *cset_cgroup_from_root(struct css_set *cset,
                                            struct cgroup_root *root)
 {
-       lockdep_assert_held(&cgroup_mutex);
        lockdep_assert_held(&css_set_lock);
 
        return __cset_cgroup_from_root(cset, root);
@@ -1457,7 +1468,9 @@ static struct cgroup *cset_cgroup_from_root(struct css_set *cset,
 
 /*
  * Return the cgroup for "task" from the given hierarchy. Must be
- * called with cgroup_mutex and css_set_lock held.
+ * called with css_set_lock held to prevent task's groups from being modified.
+ * Must be called with either cgroup_mutex or rcu read lock to prevent the
+ * cgroup root from being destroyed.
  */
 struct cgroup *task_cgroup_from_root(struct task_struct *task,
                                     struct cgroup_root *root)
@@ -2032,7 +2045,7 @@ void init_cgroup_root(struct cgroup_fs_context *ctx)
        struct cgroup_root *root = ctx->root;
        struct cgroup *cgrp = &root->cgrp;
 
-       INIT_LIST_HEAD(&root->root_list);
+       INIT_LIST_HEAD_RCU(&root->root_list);
        atomic_set(&root->nr_cgrps, 1);
        cgrp->root = root;
        init_cgroup_housekeeping(cgrp);
@@ -2115,7 +2128,7 @@ int cgroup_setup_root(struct cgroup_root *root, u16 ss_mask)
         * care of subsystems' refcounts, which are explicitly dropped in
         * the failure exit path.
         */
-       list_add(&root->root_list, &cgroup_roots);
+       list_add_rcu(&root->root_list, &cgroup_roots);
        cgroup_root_count++;
 
        /*
@@ -6242,7 +6255,7 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns,
        if (!buf)
                goto out;
 
-       cgroup_lock();
+       rcu_read_lock();
        spin_lock_irq(&css_set_lock);
 
        for_each_root(root) {
@@ -6253,6 +6266,11 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns,
                if (root == &cgrp_dfl_root && !READ_ONCE(cgrp_dfl_visible))
                        continue;
 
+               cgrp = task_cgroup_from_root(tsk, root);
+               /* The root has already been unmounted. */
+               if (!cgrp)
+                       continue;
+
                seq_printf(m, "%d:", root->hierarchy_id);
                if (root != &cgrp_dfl_root)
                        for_each_subsys(ss, ssid)
@@ -6263,9 +6281,6 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns,
                        seq_printf(m, "%sname=%s", count ? "," : "",
                                   root->name);
                seq_putc(m, ':');
-
-               cgrp = task_cgroup_from_root(tsk, root);
-
                /*
                 * On traditional hierarchies, all zombie tasks show up as
                 * belonging to the root cgroup.  On the default hierarchy,
@@ -6297,7 +6312,7 @@ int proc_cgroup_show(struct seq_file *m, struct pid_namespace *ns,
        retval = 0;
 out_unlock:
        spin_unlock_irq(&css_set_lock);
-       cgroup_unlock();
+       rcu_read_unlock();
        kfree(buf);
 out:
        return retval;