cgroups: fix possible use after free
authorLi Zefan <lizf@cn.fujitsu.com>
Wed, 18 Feb 2009 22:48:20 +0000 (14:48 -0800)
committerLinus Torvalds <torvalds@linux-foundation.org>
Wed, 18 Feb 2009 23:37:54 +0000 (15:37 -0800)
In cgroup_kill_sb(), root is freed before sb is detached from the list, so
another sget() may find this sb and call cgroup_test_super(), which will
access the root that has been freed.

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Li Zefan <lizf@cn.fujitsu.com>
Acked-by: Paul Menage <menage@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
kernel/cgroup.c

index e14db9c089b9db31df71296b199f173974b7410e..9edb5c4b79b4f1a88a0487f588c36fc6207f54a9 100644 (file)
@@ -1122,8 +1122,8 @@ static void cgroup_kill_sb(struct super_block *sb) {
 
        mutex_unlock(&cgroup_mutex);
 
-       kfree(root);
        kill_litter_super(sb);
+       kfree(root);
 }
 
 static struct file_system_type cgroup_fs_type = {