1 files changed, 16 insertions, 3 deletions

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 5a77ca0784a6..b15058602120 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -92,6 +92,12 @@ static DEFINE_MUTEX(cgroup_mutex);
 
 static DEFINE_MUTEX(cgroup_root_mutex);
 
+/*
+ * Protects cgroup_subsys->release_agent_path.  Modifying it also requires
+ * cgroup_mutex.  Reading requires either cgroup_mutex or this spinlock.
+ */
+static DEFINE_SPINLOCK(release_agent_path_lock);
+
 #define cgroup_assert_mutex_or_rcu_locked()                             \
         rcu_lockdep_assert(rcu_read_lock_held() ||                      \
                            lockdep_is_held(&cgroup_mutex),              \
@@ -1034,7 +1040,6 @@ static int cgroup_show_options(struct seq_file *seq, struct dentry *dentry)
         struct cgroup_subsys *ss;
         int ssid;
 
-        mutex_lock(&cgroup_root_mutex);
         for_each_subsys(ss, ssid)
                 if (root->subsys_mask & (1 << ssid))
                         seq_printf(seq, ",%s", ss->name);
@@ -1044,13 +1049,16 @@ static int cgroup_show_options(struct seq_file *seq, struct dentry *dentry)
                 seq_puts(seq, ",noprefix");
         if (root->flags & CGRP_ROOT_XATTR)
                 seq_puts(seq, ",xattr");
+
+        spin_lock(&release_agent_path_lock);
         if (strlen(root->release_agent_path))
                 seq_printf(seq, ",release_agent=%s", root->release_agent_path);
+        spin_unlock(&release_agent_path_lock);
+
         if (test_bit(CGRP_CPUSET_CLONE_CHILDREN, &root->top_cgroup.flags))
                 seq_puts(seq, ",clone_children");
         if (strlen(root->name))
                 seq_printf(seq, ",name=%s", root->name);
-        mutex_unlock(&cgroup_root_mutex);
         return 0;
 }
 
@@ -1272,8 +1280,11 @@ static int cgroup_remount(struct super_block *sb, int *flags, char *data)
         if (ret)
                 goto out_unlock;
 
-        if (opts.release_agent)
+        if (opts.release_agent) {
+                spin_lock(&release_agent_path_lock);
                 strcpy(root->release_agent_path, opts.release_agent);
+                spin_unlock(&release_agent_path_lock);
+        }
  out_unlock:
         kfree(opts.release_agent);
         kfree(opts.name);
@@ -2183,7 +2194,9 @@ static int cgroup_release_agent_write(struct cgroup_subsys_state *css,
         if (!cgroup_lock_live_group(css->cgroup))
                 return -ENODEV;
         mutex_lock(&cgroup_root_mutex);
+        spin_lock(&release_agent_path_lock);
         strcpy(css->cgroup->root->release_agent_path, buffer);
+        spin_unlock(&release_agent_path_lock);
         mutex_unlock(&cgroup_root_mutex);
         mutex_unlock(&cgroup_mutex);
         return 0;