cgroup: fix cgroup_path() vs rename() race

rename() will change dentry->d_name. The result of this race can
be worse than seeing partially rewritten name, but we might access
a stale pointer because rename() will re-allocate memory to hold
a longer name.

As accessing dentry->name must be protected by dentry->d_lock or
parent inode's i_mutex, while on the other hand cgroup-path() can
be called with some irq-safe spinlocks held, we can't generate
cgroup path using dentry->d_name.

Alternatively we make a copy of dentry->d_name and save it in
cgrp->name when a cgroup is created, and update cgrp->name at
rename().

v5: use flexible array instead of zero-size array.
v4: - allocate root_cgroup_name and all root_cgroup->name points to it.
    - add cgroup_name() wrapper.
v3: use kfree_rcu() instead of synchronize_rcu() in user-visible path.
v2: make cgrp->name RCU safe.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

This commit is contained in:

Li Zefan

2013-03-01 15:01:56 +08:00

committed by

Tejun Heo

parent 6dbe51c251

commit 65dff759d2

3 changed files with 100 additions and 32 deletions

									
										block/blk-cgroup.h
									
		-2
	
												View File
												
				@@ -247,9 +247,7 @@ static inline int blkg_path(struct blkcg_gq *blkg, char *buf, int buflen)

				{

					int ret;

					rcu_read_lock();

					ret = cgroup_path(blkg->blkcg->css.cgroup, buf, buflen);

					rcu_read_unlock();

					if (ret)

						strncpy(buf, "<unavailable>", buflen);

					return ret;