linux-kernel - [PATCH 1/2] cgroup: get a ref to source csses when migrating

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <1440335432-4202-2-git-send-email-cyphar@cyphar.com>
Date:	Sun, 23 Aug 2015 23:10:31 +1000
From:	Aleksa Sarai <cyphar@...har.com>
To:	tj@...nel.org
Cc:	linux-kernel@...r.kernel.org, cgroups@...r.kernel.org,
	Aleksa Sarai <cyphar@...har.com>
Subject: [PATCH 1/2] cgroup: get a ref to source csses when migrating

Grab a ref to each source css being migrated from, otherwise it's
possible for the refcount to reach zero between ->can_attach() and
->cancel_attach(). This means that operations on the task's old css
(such as container_of(...)) become unsafe, as we may be operating on a
different css.

Signed-off-by: Aleksa Sarai <cyphar@...har.com>
---
 kernel/cgroup.c | 21 +++++++++++++++++++--
 1 file changed, 19 insertions(+), 2 deletions(-)

diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 4ec1b7ee5de8..6cbfbe36284d 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2305,6 +2305,17 @@ static int cgroup_migrate(struct cgroup *cgrp, struct task_struct *leader,
 	if (list_empty(&tset.src_csets))
 		return 0;
 
+	/*
+	 * Fetch a ref of each css, so that the old task's css doesn't get reaped
+	 * between ->can_attach() and ->cancel_attach().
+	 */
+	down_read(&css_set_rwsem);
+	list_for_each_entry(cset, &tset.src_csets, mg_node) {
+		for_each_e_css(css, i, cgrp)
+			css_get(cset->subsys[i]);
+	}
+	up_read(&css_set_rwsem);
+
 	/* check that we can legitimately attach to the cgroup */
 	for_each_e_css(css, i, cgrp) {
 		if (css->ss->can_attach) {
@@ -2341,7 +2352,7 @@ static int cgroup_migrate(struct cgroup *cgrp, struct task_struct *leader,
 			css->ss->attach(css, &tset);
 
 	ret = 0;
-	goto out_release_tset;
+	goto out_deref_src;
 
 out_cancel_attach:
 	for_each_e_css(css, i, cgrp) {
@@ -2350,7 +2361,13 @@ out_cancel_attach:
 		if (css->ss->cancel_attach)
 			css->ss->cancel_attach(css, &tset);
 	}
-out_release_tset:
+out_deref_src:
+	down_read(&css_set_rwsem);
+	list_for_each_entry(cset, &tset.src_csets, mg_node) {
+		for_each_e_css(css, i, cgrp)
+			css_put(cset->subsys[i]);
+	}
+	up_read(&css_set_rwsem);
 	down_write(&css_set_rwsem);
 	list_splice_init(&tset.dst_csets, &tset.src_csets);
 	list_for_each_entry_safe(cset, tmp_cset, &tset.src_csets, mg_node) {
-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/