cpuset: rcu_read_lock() to protect task_cs()

task_cs() calls task_subsys_state().

We must use rcu_read_lock() to protect cgroup_subsys_state().

It's correct that top_cpuset is never freed, but cgroup_subsys_state()
accesses css_set, this css_set maybe freed when task_cs() called.

We use use rcu_read_lock() to protect it.

Signed-off-by: Lai Jiangshan <laijs@cn.fujitsu.com>
Acked-by: Paul Menage <menage@google.com>
Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Cc: Balbir Singh <balbir@in.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 3 insertions, 8 deletions

diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index 345ace5117de..a841b5c01ef9 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -375,14 +375,9 @@ void cpuset_update_task_memory_state(void)
         struct task_struct *tsk = current;
         struct cpuset *cs;
 
-        if (task_cs(tsk) == &top_cpuset) {
-                /* Don't need rcu for top_cpuset.  It's never freed. */
-                my_cpusets_mem_gen = top_cpuset.mems_generation;
-        } else {
-                rcu_read_lock();
-                my_cpusets_mem_gen = task_cs(tsk)->mems_generation;
-                rcu_read_unlock();
-        }
+        rcu_read_lock();
+        my_cpusets_mem_gen = task_cs(tsk)->mems_generation;
+        rcu_read_unlock();
 
         if (my_cpusets_mem_gen != tsk->cpuset_mems_generation) {
                 mutex_lock(&callback_mutex);