[Devel] Re: [PATCH] cgroups: fix possible use after free

[Al Viro]

On Tue, Feb 10, 2009 at 02:15:36AM -0800, Paul Menage wrote:
> On Tue, Feb 10, 2009 at 1:31 AM, Li Zefan <lizf at cn.fujitsu.com> wrote:
> > In cgroup_kill_sb(), root is freed before sb is detached from the list,
> > so another sget() may find this sb and call cgroup_test_super(),
> > which will access the root that has been freed.
> 
> I think that I'd assumed that by the time we get to cgroup_kill_sb()
> there's no chance of the sb being resurrected by sget().

There is none.  grab_super() will fail to get it, so sget() will go
through retry logics.  Which doesn't mean that test won't be called
on it in the meanwhile.
_______________________________________________
Containers mailing list
Containers at lists.linux-foundation.org
https://lists.linux-foundation.org/mailman/listinfo/containers