cgroup: css_task_iter_skip()'d iterators must be advanced before acce…

…ssed b636fd3 ("cgroup: Implement css_task_iter_skip()") introduced css_task_iter_skip() which is used to fix task iterations skipping dying threadgroup leaders with live threads. Skipping is implemented as a subportion of full advancing but css_task_iter_next() forgot to fully advance a skipped iterator before determining the next task to visit causing it to return invalid task pointers. Fix it by making css_task_iter_next() fully advance the iterator if it has been skipped since the previous iteration. Signed-off-by: Tejun Heo <[email protected]> Reported-by: syzbot Link: http://lkml.kernel.org/r/[email protected] Fixes: b636fd3 ("cgroup: Implement css_task_iter_skip()")
schnitzeltony · Jun 5, 2019 · cee0c33 · cee0c33
1 parent c03cd77
commit cee0c33
Showing 1 changed file with 4 additions and 0 deletions.
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
@@ -4550,6 +4550,10 @@ struct task_struct *css_task_iter_next(struct css_task_iter *it)
 
 	spin_lock_irq(&css_set_lock);
 
+	/* @it may be half-advanced by skips, finish advancing */
+	if (it->flags & CSS_TASK_ITER_SKIPPED)
+		css_task_iter_advance(it);
+
 	if (it->task_pos) {
 		it->cur_task = list_entry(it->task_pos, struct task_struct,
 					  cg_list);