cgroup: fix cgroup_path() vs rename() race

rename() will change dentry->d_name. The result of this race can
be worse than seeing partially rewritten name, but we might access
a stale pointer because rename() will re-allocate memory to hold
a longer name.

As accessing dentry->name must be protected by dentry->d_lock or
parent inode's i_mutex, while on the other hand cgroup-path() can
be called with some irq-safe spinlocks held, we can't generate
cgroup path using dentry->d_name.

Alternatively we make a copy of dentry->d_name and save it in
cgrp->name when a cgroup is created, and update cgrp->name at
rename().

v5: use flexible array instead of zero-size array.
v4: - allocate root_cgroup_name and all root_cgroup->name points to it.
    - add cgroup_name() wrapper.
v3: use kfree_rcu() instead of synchronize_rcu() in user-visible path.
v2: make cgrp->name RCU safe.

Signed-off-by: Li Zefan <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>

1 files changed, 24 insertions, 0 deletions

diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index 900af5964f55..75c6ec1ba1ba 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -150,6 +150,11 @@ enum {
         CGRP_CPUSET_CLONE_CHILDREN,
 };
 
+struct cgroup_name {
+        struct rcu_head rcu_head;
+        char name[];
+};
+
 struct cgroup {
         unsigned long flags;            /* "unsigned long" so bitops work */
 
@@ -172,6 +177,19 @@ struct cgroup {
         struct cgroup *parent;          /* my parent */
         struct dentry *dentry;          /* cgroup fs entry, RCU protected */
 
+        /*
+         * This is a copy of dentry->d_name, and it's needed because
+         * we can't use dentry->d_name in cgroup_path().
+         *
+         * You must acquire rcu_read_lock() to access cgrp->name, and
+         * the only place that can change it is rename(), which is
+         * protected by parent dir's i_mutex.
+         *
+         * Normally you should use cgroup_name() wrapper rather than
+         * access it directly.
+         */
+        struct cgroup_name __rcu *name;
+
         /* Private pointers for each registered subsystem */
         struct cgroup_subsys_state *subsys[CGROUP_SUBSYS_COUNT];
 
@@ -404,6 +422,12 @@ struct cgroup_scanner {
         void *data;
 };
 
+/* Caller should hold rcu_read_lock() */
+static inline const char *cgroup_name(const struct cgroup *cgrp)
+{
+        return rcu_dereference(cgrp->name)->name;
+}
+
 int cgroup_add_cftypes(struct cgroup_subsys *ss, struct cftype *cfts);
 int cgroup_rm_cftypes(struct cgroup_subsys *ss, struct cftype *cfts);