linux-kernel - Re: [PATCH 1/9] cgroup: fix css leaks on online

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <52245DE0.1010701@huawei.com>
Date:	Mon, 2 Sep 2013 17:44:00 +0800
From:	Li Zefan <lizefan@...wei.com>
To:	Tejun Heo <tj@...nel.org>
CC:	<containers@...ts.linux-foundation.org>, <cgroups@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/9] cgroup: fix css leaks on online_css() failure

On 2013/8/29 5:03, Tejun Heo wrote:
> ae7f164a09 ("cgroup: move cgroup->subsys[] assignment to
> online_css()") moved cgroup->subsys[] assignements later in
> cgroup_create() but didn't update error handling path accordingly
> leaking later css's after an online_css() failure.
> 
> This patch moves reference bumping inside online_css() loop, clears
> css_ar[] as css's are brought online successfully, and updates
> err_destroy path so that either a css is fully online and destroyed by
> cgroup_destroy_locked() or the error path frees it.  This creates a
> duplicate css free logic in the error path but it will be cleaned up
> soon.
> 
> Signed-off-by: Tejun Heo <tj@...nel.org>
> ---
>  kernel/cgroup.c | 23 +++++++++++++++--------
>  1 file changed, 15 insertions(+), 8 deletions(-)
> 
> diff --git a/kernel/cgroup.c b/kernel/cgroup.c
> index b5f4989..a4168cf 100644
> --- a/kernel/cgroup.c
> +++ b/kernel/cgroup.c
> @@ -4489,14 +4489,6 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
>  	list_add_tail_rcu(&cgrp->sibling, &cgrp->parent->children);
>  	root->number_of_cgroups++;
>  
> -	/* each css holds a ref to the cgroup's dentry and the parent css */
> -	for_each_root_subsys(root, ss) {
> -		struct cgroup_subsys_state *css = css_ar[ss->subsys_id];
> -
> -		dget(dentry);
> -		css_get(css->parent);
> -	}
> -
>  	/* hold a ref to the parent's dentry */
>  	dget(parent->dentry);
>  
> @@ -4508,6 +4500,13 @@ static long cgroup_create(struct cgroup *parent, struct dentry *dentry,
>  		if (err)
>  			goto err_destroy;

If online_css() returns -error, it means cgroup->subsys[ss->subsys_id] == NULL,

>  
> +		/* each css holds a ref to the cgroup's dentry and parent css */
> +		dget(dentry);
> +		css_get(css->parent);
> +
> +		/* mark it consumed for error path */
> +		css_ar[ss->subsys_id] = NULL;
> +
>  		if (ss->broken_hierarchy && !ss->warned_broken_hierarchy &&
>  		    parent->parent) {
>  			pr_warning("cgroup: %s (%d) created nested cgroup for controller \"%s\" which has incomplete hierarchy support. Nested cgroups may change behavior in the future.\n",
> @@ -4554,6 +4553,14 @@ err_free_cgrp:
>  	return err;
>  
>  err_destroy:
> +	for_each_root_subsys(root, ss) {
> +		struct cgroup_subsys_state *css = css_ar[ss->subsys_id];
> +
> +		if (css) {
> +			percpu_ref_cancel_init(&css->refcnt);
> +			ss->css_free(css);
> +		}
> +	}
>  	cgroup_destroy_locked(cgrp);

Now cgroup_destroy_locked() is called:

	for_each_root_subsys(cgrp->root, ss)
		kill_css(cgroup_css(cgrp, ss));

cgroup_css(cgrp, ss) will return NULL and pass it to kill_css(), which leads
to NULL pointer deref ?

>  	mutex_unlock(&cgroup_mutex);
>  	mutex_unlock(&dentry->d_inode->i_mutex);
> 

(I'll go through the patchset tomorrow.)

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/