lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:	Sun, 23 Aug 2015 23:10:31 +1000
From:	Aleksa Sarai <cyphar@...har.com>
To:	tj@...nel.org
Cc:	linux-kernel@...r.kernel.org, cgroups@...r.kernel.org,
	Aleksa Sarai <cyphar@...har.com>
Subject: [PATCH 1/2] cgroup: get a ref to source csses when migrating

Grab a ref to each source css being migrated from, otherwise it's
possible for the refcount to reach zero between ->can_attach() and
->cancel_attach(). This means that operations on the task's old css
(such as container_of(...)) become unsafe, as we may be operating on a
different css.

Signed-off-by: Aleksa Sarai <cyphar@...har.com>
---
 kernel/cgroup.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 4ec1b7ee5de8..6cbfbe36284d 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2305,6 +2305,17 @@ static int cgroup_migrate(struct cgroup *cgrp, struct task_struct *leader,
 	if (list_empty(&tset.src_csets))
 		return 0;
 
+	/*
+	 * Fetch a ref of each css, so that the old task's css doesn't get reaped
+	 * between ->can_attach() and ->cancel_attach().
+	 */
+	down_read(&css_set_rwsem);
+	list_for_each_entry(cset, &tset.src_csets, mg_node) {
+		for_each_e_css(css, i, cgrp)
+			css_get(cset->subsys[i]);
+	}
+	up_read(&css_set_rwsem);
+
 	/* check that we can legitimately attach to the cgroup */
 	for_each_e_css(css, i, cgrp) {
 		if (css->ss->can_attach) {
@@ -2341,7 +2352,7 @@ static int cgroup_migrate(struct cgroup *cgrp, struct task_struct *leader,
 			css->ss->attach(css, &tset);
 
 	ret = 0;
-	goto out_release_tset;
+	goto out_deref_src;
 
 out_cancel_attach:
 	for_each_e_css(css, i, cgrp) {
@@ -2350,7 +2361,13 @@ out_cancel_attach:
 		if (css->ss->cancel_attach)
 			css->ss->cancel_attach(css, &tset);
 	}
-out_release_tset:
+out_deref_src:
+	down_read(&css_set_rwsem);
+	list_for_each_entry(cset, &tset.src_csets, mg_node) {
+		for_each_e_css(css, i, cgrp)
+			css_put(cset->subsys[i]);
+	}
+	up_read(&css_set_rwsem);
 	down_write(&css_set_rwsem);
 	list_splice_init(&tset.dst_csets, &tset.src_csets);
 	list_for_each_entry_safe(cset, tmp_cset, &tset.src_csets, mg_node) {
-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Powered by blists - more mailing lists