linux-kernel - Re: cgroup user-after-free

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 1 Feb 2023 06:04:04 +0000
From:   Lixiong Liu (刘利雄) 
        <Lixiong.Liu@...iatek.com>
To:     "tj@...nel.org" <tj@...nel.org>
CC:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-mediatek@...ts.infradead.org" 
        <linux-mediatek@...ts.infradead.org>,
        "cgroups@...r.kernel.org" <cgroups@...r.kernel.org>,
        Wenju Xu (许文举) <Wenju.Xu@...iatek.com>,
        wsd_upstream <wsd_upstream@...iatek.com>,
        Jing-Ting Wu (吳靜婷) 
        <Jing-Ting.Wu@...iatek.com>,
        "hannes@...xchg.org" <hannes@...xchg.org>,
        WJ Wang (王军) <wj.wang@...iatek.com>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        Andress Kuo (郭孟修) 
        <Andress.Kuo@...iatek.com>,
        "matthias.bgg@...il.com" <matthias.bgg@...il.com>
Subject: Re: cgroup user-after-free

On Fri, 2023-01-13 at 13:40 +0800, lixiong liu wrote:
> > > Root cause: 
> > > cgroup_migrate_finish free cset’s cgroup,
> > > 
> > > but cgroup_sk_alloc use the freed cgroup,
> > > 
> > > then use-after-free happened.
> > 
> > Sounds similar to the problem fixed by 07fd5b6cdf3c ("cgroup: Use
> > separate
> > src/dst nodes when preloading css_sets for migration"). Can you try
> > it out?
> > 
> > Thanks.
> > 
> 
> 
> Thanks for your quick feedback.
> 
> 
>   
> But we encountered use-after-free version
> 
> already contains this patch.
> 
> 
> 
> So, with this patch will also encounter
> 
> this use-after-free.
> 
> Thanks!
> 
> 
  Do you have any suggestion for this issue?

  Best regards,
  Lixiong Liu