The patch titled devcgroup: fix race against rmdir() has been added to the -mm tree. Its filename is devcgroup-fix-race-against-rmdir.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://www.zip.com.au/~akpm/linux/patches/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: devcgroup: fix race against rmdir() From: Li Zefan <lizf@xxxxxxxxxxxxxx> During the use of a dev_cgroup, we should guarantee the corresponding cgroup won't be deleted (i.e. via rmdir). This can be done through css_get(&dev_cgroup->css), but here we can just get and use the dev_cgroup under rcu_read_lock. And also remove checking NULL dev_cgroup, it won't be NULL since a task always belongs to a cgroup. Signed-off-by: Li Zefan <lizf@xxxxxxxxxxxxxx> Acked-by: Serge Hallyn <serue@xxxxxxxxxx> Cc: Paul Menage <menage@xxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- security/device_cgroup.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff -puN security/device_cgroup.c~devcgroup-fix-race-against-rmdir security/device_cgroup.c --- a/security/device_cgroup.c~devcgroup-fix-race-against-rmdir +++ a/security/device_cgroup.c @@ -508,12 +508,11 @@ int devcgroup_inode_permission(struct in return 0; if (!S_ISBLK(inode->i_mode) && !S_ISCHR(inode->i_mode)) return 0; - dev_cgroup = css_to_devcgroup(task_subsys_state(current, - devices_subsys_id)); - if (!dev_cgroup) - return 0; rcu_read_lock(); + + dev_cgroup = task_devcgroup(current); + list_for_each_entry_rcu(wh, &dev_cgroup->whitelist, list) { if (wh->type & DEV_ALL) goto acc_check; @@ -533,6 +532,7 @@ acc_check: rcu_read_unlock(); return 0; } + rcu_read_unlock(); return -EPERM; @@ -543,12 +543,10 @@ int devcgroup_inode_mknod(int mode, dev_ struct dev_cgroup *dev_cgroup; struct dev_whitelist_item *wh; - dev_cgroup = css_to_devcgroup(task_subsys_state(current, - devices_subsys_id)); - if (!dev_cgroup) - return 0; - rcu_read_lock(); + + dev_cgroup = task_devcgroup(current); + list_for_each_entry(wh, &dev_cgroup->whitelist, list) { if (wh->type & DEV_ALL) goto acc_check; @@ -566,6 +564,8 @@ acc_check: rcu_read_unlock(); return 0; } + rcu_read_unlock(); + return -EPERM; } _ Patches currently in -mm which might be from lizf@xxxxxxxxxxxxxx are devcgroup-fix-race-against-rmdir.patch linux-next.patch memrlimit-cgroup-mm-owner-callback-changes-to-add-task-info.patch memrlimit-add-memrlimit-controller-documentation.patch memrlimit-setup-the-memrlimit-controller.patch memrlimit-add-memrlimit-controller-accounting-and-control.patch memrlimit-add-memrlimit-controller-accounting-and-control-memory-rlimit-enhance-mm_owner_changed-callback-to-deal-with-exited-owner.patch memrlimit-add-memrlimit-controller-accounting-and-control-memory-rlimit-fix-crash-on-fork.patch memrlimit-improve-error-handling.patch memrlimit-improve-error-handling-update.patch memrlimit-handle-attach_task-failure-add-can_attach-callback.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html