linux-kernel - Re: cgroup user-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <f8b24df3bd009d112479e9d5db36ec4afff9bb71.camel@mediatek.com>
Date:   Fri, 13 Jan 2023 05:40:08 +0000
From:   Lixiong Liu (刘利雄) 
        <Lixiong.Liu@...iatek.com>
To:     "tj@...nel.org" <tj@...nel.org>
CC:     "lizefan@...wei.com" <lizefan@...wei.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-mediatek@...ts.infradead.org" 
        <linux-mediatek@...ts.infradead.org>,
        "cgroups@...r.kernel.org" <cgroups@...r.kernel.org>,
        Wenju Xu (许文举) <Wenju.Xu@...iatek.com>,
        wsd_upstream <wsd_upstream@...iatek.com>,
        Jing-Ting Wu (吳靜婷) 
        <Jing-Ting.Wu@...iatek.com>,
        "hannes@...xchg.org" <hannes@...xchg.org>,
        WJ Wang (王军) <wj.wang@...iatek.com>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        Andress Kuo (郭孟修) 
        <Andress.Kuo@...iatek.com>,
        "matthias.bgg@...il.com" <matthias.bgg@...il.com>
Subject: Re: cgroup user-after-free

> > Root cause: 
> > cgroup_migrate_finish free cset’s cgroup,
> > 
> > but cgroup_sk_alloc use the freed cgroup,
> > 
> > then use-after-free happened.
> 
> Sounds similar to the problem fixed by 07fd5b6cdf3c ("cgroup: Use
> separate
> src/dst nodes when preloading css_sets for migration"). Can you try
> it out?
> 
> Thanks.
> 


Thanks for your quick feedback.


  
But we encountered use-after-free version

already contains this patch.



So, with this patch will also encounter

this use-after-free.

Thanks!



Best regards,
Lixiong Liu