| commit | 67e055d144c5b2acdc1c63811fde031263bf92c5 | |
| author | Li Zefan <lizf@cn.fujitsu.com> | |
| Wed, 18 Feb 2009 22:48:20 +0000 (18 14:48 -0800) | ||
| committer | Linus Torvalds <torvalds@linux-foundation.org> | |
| Wed, 18 Feb 2009 23:37:54 +0000 (18 15:37 -0800) | ||
| tree | 6bdb0af25cc30d7bc8a8d54db3625f8486c2f5f9 | treesnapshot (tar.gz zip) |
| parent | 1cf6e7d83bf334cc5916137862c920a97aabc018 | commitdiff |
cgroups: fix possible use after free
In cgroup_kill_sb(), root is freed before sb is detached from the list, so
another sget() may find this sb and call cgroup_test_super(), which will
access the root that has been freed.
Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Paul Menage <menage@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
In cgroup_kill_sb(), root is freed before sb is detached from the list, so
another sget() may find this sb and call cgroup_test_super(), which will
access the root that has been freed.
Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Paul Menage <menage@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| kernel/cgroup.c | diffblobblamehistory |