linux-kernel - Re: cgroup user-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y8Cwdsk5pYNd8fX8@slm.duckdns.org>
Date:   Thu, 12 Jan 2023 15:14:30 -1000
From:   "tj@...nel.org" <tj@...nel.org>
To:     Lixiong Liu (刘利雄) 
        <Lixiong.Liu@...iatek.com>
Cc:     "lizefan@...wei.com" <lizefan@...wei.com>,
        "hannes@...xchg.org" <hannes@...xchg.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-mediatek@...ts.infradead.org" 
        <linux-mediatek@...ts.infradead.org>,
        "cgroups@...r.kernel.org" <cgroups@...r.kernel.org>,
        Wenju Xu (许文举) <Wenju.Xu@...iatek.com>,
        wsd_upstream <wsd_upstream@...iatek.com>,
        Jing-Ting Wu (吳靜婷) 
        <Jing-Ting.Wu@...iatek.com>,
        WJ Wang (王军) <wj.wang@...iatek.com>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        Andress Kuo (郭孟修) 
        <Andress.Kuo@...iatek.com>,
        "matthias.bgg@...il.com" <matthias.bgg@...il.com>
Subject: Re: cgroup user-after-free

On Thu, Jan 12, 2023 at 09:48:55AM +0000, Lixiong Liu (刘利雄) wrote:
> Hi,
> 
> We meet cgroup use-after-free happened in T SW version with 
> 
> kernel-5.15.
>  
> Root cause: 
> cgroup_migrate_finish free cset’s cgroup,
> 
> but cgroup_sk_alloc use the freed cgroup,
> 
> then use-after-free happened.

Sounds similar to the problem fixed by 07fd5b6cdf3c ("cgroup: Use separate
src/dst nodes when preloading css_sets for migration"). Can you try it out?

Thanks.

-- 
tejun