Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 22:09:30 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge tag 'cgroup-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Browse Source 
Pull cgroup fix from Tejun Heo:

 - The task iterator could pick up a dying task whose refcount had
   already dropped to zero and resurrect it, leading to a use-after-free
   when reading cgroup.procs. Skip such tasks.

* tag 'cgroup-for-7.3-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup: Avoid iteration of dying tasks with zero refcount
This commit is contained in:
Linus Torvalds
2026-09-15 11:40:30 -07:00
parent f6e7b42bf0 057dac23d3
commit 6fb20c0271
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/cgroup/cgroup.c
+5 -2
View File
@@ -5303,10 +5303,13 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
if (it->flags & CSS_TASK_ITER_SKIPPED)
css_task_iter_advance(it);
if (it->task_pos) {
while (it->task_pos && !it->cur_task) {
it->cur_task = list_entry(it->task_pos, struct task_struct,
cg_list);
get_task_struct(it->cur_task);
/* a task on dying_tasks with zero refcount is only valid for
* RCU readers, not even interesting for
* CSS_TASK_ITER_WITH_DEAD, find another one */
it->cur_task = tryget_task_struct(it->cur_task);
css_task_iter_advance(it);
}