In autogroup_create(), a tg is allocated and added to the task_groups list. If CONFIG_RT_GROUP_SCHED is set, this tg is then modified while on the list, without locking. This can race with someone walking the list, like __enable_runtime() during CPU unplug, and result in a use-after-free bug. To fix this, move sched_online_group(), which adds the tg to the list, to the end of the autogroup_create() function after the modification. Signed-off-by: Gerald Schaefer <gerald.schaefer@de.ibm.com> Signed-off-by: Peter Zijlstra <peterz@infradead.org> Link: http://lkml.kernel.org/r/1369411669-46971-2-git-send-email-gerald.schaefer@de.ibm.com Signed-off-by: Ingo Molnar <mingo@kernel.org> |
||
---|---|---|
.. | ||
auto_group.c | ||
auto_group.h | ||
clock.c | ||
core.c | ||
cpuacct.c | ||
cpuacct.h | ||
cpupri.c | ||
cpupri.h | ||
cputime.c | ||
debug.c | ||
fair.c | ||
features.h | ||
idle_task.c | ||
Makefile | ||
proc.c | ||
rt.c | ||
sched.h | ||
stats.c | ||
stats.h | ||
stop_task.c |