On Fri, 2010-12-31 at 09:32 +0100, Mike Galbraith wrote: > sched: fix autogroup reference leak and cpu_cgroup_exit() explosion > > In the event of a fork failure, the new cpu_cgroup_exit() method tries to > move an unhashed task. Since PF_EXITING isn't set in that case, autogroup > will dig aground in a freed signal_struct. Neither cgroups nor autogroup > has anything it needs to do with this shade, so don't go there. > > This also uncovered a struct autogroup reference leak. copy_process() was > simply freeing vs putting the signal_struct, stranding a reference. > > Signed-off-by: Mike Galbraith <efault@xxxxxx> > > --- > kernel/fork.c | 2 +- > kernel/sched.c | 10 ++++++++++ > 2 files changed, 11 insertions(+), 1 deletion(-) > > Index: linux-2.6.37.git/kernel/fork.c > =================================================================== > --- linux-2.6.37.git.orig/kernel/fork.c > +++ linux-2.6.37.git/kernel/fork.c > @@ -1318,7 +1318,7 @@ bad_fork_cleanup_mm: > } > bad_fork_cleanup_signal: > if (!(clone_flags & CLONE_THREAD)) > - free_signal_struct(p->signal); > + put_signal_struct(p->signal); > bad_fork_cleanup_sighand: > __cleanup_sighand(p->sighand); > bad_fork_cleanup_fs: > Index: linux-2.6.37.git/kernel/sched.c > =================================================================== > --- linux-2.6.37.git.orig/kernel/sched.c > +++ linux-2.6.37.git/kernel/sched.c > @@ -9193,6 +9193,16 @@ cpu_cgroup_attach(struct cgroup_subsys * > static void > cpu_cgroup_exit(struct cgroup_subsys *ss, struct task_struct *task) > { > + /* > + * cgroup_exit() is called in the copy_process failure path. > + * The task isn't hashed, and we don't want to make autogroup > + * dig into a freed signal_struct, so just go away. > + * > + * XXX: why are cgroup methods diddling unattached tasks? > + */ > + if (!(task->flags & PF_EXITING)) > + return; > + > sched_move_task(task); > } Ah, that looks plausible. I've folded this chunk into my patch and kept your fork-fail mod in a separate patch. -- To unsubscribe from this list: send the line "unsubscribe kernel-janitors" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html