diff options
author | Li Zefan <lizefan@huawei.com> | 2014-04-17 13:53:08 +0800 |
---|---|---|
committer | Tejun Heo <tj@kernel.org> | 2014-04-17 11:18:06 -0400 |
commit | e37a06f10994c2ba86f54d8f96734f2483a869b8 (patch) | |
tree | 6b53563f1b93588d1c40c52f0eecb049b20c5cff /kernel | |
parent | c9eaa447e77efe77b7fa4c953bd62de8297fd6c5 (diff) | |
download | op-kernel-dev-e37a06f10994c2ba86f54d8f96734f2483a869b8.zip op-kernel-dev-e37a06f10994c2ba86f54d8f96734f2483a869b8.tar.gz |
cgroup: fix the retry path of cgroup_mount()
If we hit the retry path, we'll call parse_cgroupfs_options() again,
but the string we pass to it has been modified by the previous call
to this function.
This bug can be observed by:
# mount -t cgroup -o name=foo,cpuset xxx /mnt && umount /mnt && \
mount -t cgroup -o name=foo,cpuset xxx /mnt
mount: wrong fs type, bad option, bad superblock on xxx,
missing codepage or helper program, or other error
...
The second mount passed "name=foo,cpuset" to the parser, and then it
hit the retry path and call the parser again, but this time the string
passed to the parser is "name=foo".
To fix this, we avoid calling parse_cgroupfs_options() again in this
case.
Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Diffstat (limited to 'kernel')
-rw-r--r-- | kernel/cgroup.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/kernel/cgroup.c b/kernel/cgroup.c index 9fcdaa7..11a03d6 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c @@ -1495,7 +1495,7 @@ static struct dentry *cgroup_mount(struct file_system_type *fs_type, */ if (!use_task_css_set_links) cgroup_enable_task_cg_lists(); -retry: + mutex_lock(&cgroup_tree_mutex); mutex_lock(&cgroup_mutex); @@ -1503,7 +1503,7 @@ retry: ret = parse_cgroupfs_options(data, &opts); if (ret) goto out_unlock; - +retry: /* look for a matching existing root */ if (!opts.subsys_mask && !opts.none && !opts.name) { cgrp_dfl_root_visible = true; @@ -1562,9 +1562,9 @@ retry: if (!atomic_inc_not_zero(&root->cgrp.refcnt)) { mutex_unlock(&cgroup_mutex); mutex_unlock(&cgroup_tree_mutex); - kfree(opts.release_agent); - kfree(opts.name); msleep(10); + mutex_lock(&cgroup_tree_mutex); + mutex_lock(&cgroup_mutex); goto retry; } |