Re: [PATCH] cgroups: fix possible use after free

[Al Viro]

On Tue, Feb 10, 2009 at 02:15:36AM -0800, Paul Menage wrote:
> On Tue, Feb 10, 2009 at 1:31 AM, Li Zefan <lizf@xxxxxxxxxxxxxx> wrote:
> > In cgroup_kill_sb(), root is freed before sb is detached from the list,
> > so another sget() may find this sb and call cgroup_test_super(),
> > which will access the root that has been freed.
> 
> I think that I'd assumed that by the time we get to cgroup_kill_sb()
> there's no chance of the sb being resurrected by sget().

There is none.  grab_super() will fail to get it, so sget() will go
through retry logics.  Which doesn't mean that test won't be called
on it in the meanwhile.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/