The cgroup_procs_write_start() took a reference to the task structure
which was not properly released within cgroup_procs_write() and so
on. So a put_task_struct() call is added to cgroup_procs_write_finish()
to match the get_task_struct() in cgroup_procs_write_start() to fix
this reference counting error.

Signed-off-by: Waiman Long <long...@redhat.com>
---
 kernel/cgroup/cgroup-internal.h |  2 +-
 kernel/cgroup/cgroup-v1.c       |  2 +-
 kernel/cgroup/cgroup.c          | 10 ++++++----
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/kernel/cgroup/cgroup-internal.h b/kernel/cgroup/cgroup-internal.h
index f0a0dba..2c8e3a9 100644
--- a/kernel/cgroup/cgroup-internal.h
+++ b/kernel/cgroup/cgroup-internal.h
@@ -182,7 +182,7 @@ int cgroup_attach_task(struct cgroup *dst_cgrp, struct 
task_struct *leader,
                       bool threadgroup);
 struct task_struct *cgroup_procs_write_start(char *buf, bool threadgroup)
        __acquires(&cgroup_threadgroup_rwsem);
-void cgroup_procs_write_finish(void)
+void cgroup_procs_write_finish(struct task_struct *task)
        __releases(&cgroup_threadgroup_rwsem);
 
 void cgroup_lock_and_drain_offline(struct cgroup *cgrp);
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
index c212856..1e101b9 100644
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -549,7 +549,7 @@ static ssize_t __cgroup1_procs_write(struct 
kernfs_open_file *of,
        ret = cgroup_attach_task(cgrp, task, threadgroup);
 
 out_finish:
-       cgroup_procs_write_finish();
+       cgroup_procs_write_finish(task);
 out_unlock:
        cgroup_kn_unlock(of->kn);
 
diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index d7bab5e..f14deca 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -2492,12 +2492,15 @@ struct task_struct *cgroup_procs_write_start(char *buf, 
bool threadgroup)
        return tsk;
 }
 
-void cgroup_procs_write_finish(void)
+void cgroup_procs_write_finish(struct task_struct *task)
        __releases(&cgroup_threadgroup_rwsem)
 {
        struct cgroup_subsys *ss;
        int ssid;
 
+       /* release reference from cgroup_procs_write_start() */
+       put_task_struct(task);
+
        percpu_up_write(&cgroup_threadgroup_rwsem);
        for_each_subsys(ss, ssid)
                if (ss->post_attach)
@@ -3300,7 +3303,6 @@ static int cgroup_addrm_files(struct cgroup_subsys_state 
*css,
 
 static int cgroup_apply_cftypes(struct cftype *cfts, bool is_add)
 {
-       LIST_HEAD(pending);
        struct cgroup_subsys *ss = cfts[0].ss;
        struct cgroup *root = &ss->root->cgrp;
        struct cgroup_subsys_state *css;
@@ -4065,7 +4067,7 @@ static ssize_t cgroup_procs_write(struct kernfs_open_file 
*of,
        ret = cgroup_attach_task(cgrp, task, true);
 
 out_finish:
-       cgroup_procs_write_finish();
+       cgroup_procs_write_finish(task);
 out_unlock:
        cgroup_kn_unlock(of->kn);
 
@@ -4135,7 +4137,7 @@ static ssize_t cgroup_threads_write(struct 
kernfs_open_file *of,
        ret = cgroup_attach_task(cgrp, task, false);
 
 out_finish:
-       cgroup_procs_write_finish();
+       cgroup_procs_write_finish(task);
 out_unlock:
        cgroup_kn_unlock(of->kn);
 
-- 
1.8.3.1

--
To unsubscribe from this list: send the line "unsubscribe linux-doc" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Reply via email to